SQL Injection
A SQL injection vulnerability exists in qcubed profile.php via the strQuery parameter. This allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
Advisories for Composer/Qcubed/Qcubed package
2021
Improperly Controlled Modification of Dynamically-Determined Object Attributes
A PHP object injection bug in profile.php in qcubed deserializes the untrusted data of the POST-variable strProfileData and allows an unauthenticated attacker to execute code via a crafted POST request.
Cross-site Scripting
A reflected cross-site scripting (XSS) vulnerability in qcubed's profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.