https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-24T05:12:00.586564+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2017-20288 CVE-2017-20288 — QCubed 3.1.1 Reflected XSS via installer step_2.php 2026-10-24T05:12:00.587566+00:00

Affected: QCubed

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.