Quadbase's vulnerability profile centers on a focused set of business-intelligence and reporting products—Espresso Dashboard, Espresso Reports, and related enterprise server variants—where exposures cluster around web-application input handling and trust boundaries. The durable signal reflects the server-side rendering and form-processing nature of these tools, with recurring weaknesses including cross-site request forgery, cross-site scripting, and inclusion of untrusted functionality. Current severity, exploitation, and exposure figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Quadbase over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-24984HIGH An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading maliciou | Mar 11, 2021 | 8.8 | 27 | NO | NO |
CVE-2020-24983HIGH An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made to the DashboardBuild | Mar 11, 2021 | 8.8 | 27 | NO | NO |
CVE-2020-24985HIGH An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parame | Mar 15, 2021 | 8.1 | 25 | NO | NO |
CVE-2019-9958HIGH CSRF within the admin panel in Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to escalate privileges, or create new admin accounts by crafting a malicious w | Jun 24, 2019 | 8.8 | 22 | NO | NO |
CVE-2020-24982MEDIUM An issue was discovered in Quadbase ExpressDashboard (EDAB) 7 Update 9. It allows CSRF. An attacker may be able to trick an authenticated user into changing the email address assoc | Mar 15, 2021 | 4.3 | 17 | NO | NO |
CVE-2019-9957MEDIUM Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The | Jun 24, 2019 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Quadbase.
Media articles that mention a CVE ID that affects a product developed by Quadbase — matched by CVE ID, not by vendor name.