Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-24912

35
FAUCET Score

CVE-2020-24912 is a reflected cross-site scripting (XSS) vulnerability affecting all versions of qcubed, including 3.1.1, specifically within the profile.php file via the stQuery-parameter. This medium-severity vulnerability (CVSS 6.1) allows unauthenticated attackers to steal authenticated user sessions through a low-complexity attack requiring user interaction. While not actively exploited in the wild and lacking Metasploit or ExploitDB modules, Nuclei templates exist, and it has a high FAUCET Risk Score of 97/100 despite minimal community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 3.1.1CPE matchmatch criteria
cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.1MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
2.7
CvssVersion
3.1

Exploit Intelligence

EPSS Score
6.29%
Probability of exploitation in next 30 days
EPSS Percentile
92.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
Nuclei: CVE-2020-24912 · Sep 15, 2021
This CVE's current EPSS score of 0.0629 is in the 97th percentile among its peer group of 26,219 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

composerpatch availablevia ghsa
Product: qcubed/qcubedFixed in: 3.2

Vendor Advisories (1)

composerGHSA-xj4v-gp4q-h6qqmedium

qcubed reflected cross-site scripting (XSS) vulnerability

May 24, 2022

References

packetstormsecurity.com / files/161763/QCubed-3.1.1-Cross-Site-Scripting.html
seclists.org / fulldisclosure/2021/Mar/30
ExploitMailing ListThird Party Advisory
tech.feedyourhead.at / content/QCubed-Cross-Site-Scripting-CVE-2020-24912
ExploitPatchThird Party Advisory
ait.ac.at / themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03
ExploitPatchThird Party Advisory