Live › vulnerability › CVE-2017-20288
Go to dashboardQCubed 2.2.0 through 3.1.1 echoes the installation_path parameter unescaped on its installer page /assets/php/_devtools/installer/step_2.php. An attacker who lures a victim to a crafted GET link can run JavaScript in the victim's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that run QCubed between 2.2.0 and 3.1.1 with the development installer directory reachable over the web. Deployments that block or remove the directory, or that are not running QCubed, can skip it. The sources do not say whether the installer is exposed by default.
_devtoolsNo product ranges from the sources yet.
assets/php/_devtools/installer/step_2.php in the QCubed install tree/assets/php/_devtools/installer/step_2.php with installation_path values containing script or HTML3.1.1, or remove the _devtools/installer directory from productionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
This page as .md · .json · in your agent: get_signal("CVE-2017-20288")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.