CVE-2020-24914
CRITICAL EXPLOITEDQcubed < 3.1.1 - Insecure Deserialization
Title source: ruleDescription
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.
References (4)
Scores
CVSS v3
9.8
EPSS
0.3772
EPSS Percentile
97.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Intel
VulnCheck KEV
2024-01-22
Classification
CWE
CWE-502
Status
published
Affected Products (2)
qcubed/qcubed
< 3.1.1
qcubed/qcubed
< 3.2Packagist
Timeline
Published
Mar 04, 2021
Tracked Since
Feb 18, 2026