← Back to browse · API

CVE-2020-24914

Severity
CRITICAL
CVSS
9.8
EPSS
0.05074
Risk score
40.98
CISA KEV
No
PoC
No
Published
2021-03-04
Modified
2026-07-09
First seen
2026-08-05
Aliases
EUVD-2022-3071, GHSA-7W3C-JGH7-CWJW
Products
n/a:n/a n/a, qcubed:qcubed
Sources
nvd CVE-2020-24914
euvd EUVD-2022-3071

Description

A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.

References