Threat database

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

The QuestionPro Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questionpro' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.1.10 is recommended to address this issue. The patch is identified as b42fd9f18476d844ae181a10a249e003dafb823d. You should upgrade the affected component. The vendor confirmed early that the fix "is going to be released as a part of QuestDB 9.3.0" as well.

EPSS 0.3%VulnerabilityquestdbUnited StatesGermany+8

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modules) allows HTTP Request Smuggling via the Content-Length-Transfer-Encoding (CL.TE) attack vector. This could allow an attacker to bypass access controls, poison web caches, hijack sessions, or trigger unintended internal requests. This issue affects Coexistence Manager for Notes 3.8.2045. Other versions may also be affected.

EPSS 0.5%VulnerabilityQuest#cwe-444Germany+5

The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems.

EPSS 0.2%VulnerabilityQuest#cwe-863Germany+7

CVE-2025-32975 is a critical authentication bypass vulnerability in Quest KACE Systems Management Appliance (SMA) that affects the SSO authentication mechanism. It allows attackers to impersonate legitimate users without valid credentials, potentially gaining full administrative control. The vulnerability has a maximum CVSS score of 10.0, indicating severe impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild. The exact affected versions and patch status are not specified; users should consult the vendor advisory for remediation details.

CVE-2018-11138 is a remote command execution vulnerability in the Quest KACE System Management Appliance. The vulnerability arises because the '/common/download_agent_installer.php' script is accessible to anonymous users, allowing attackers to execute arbitrary commands remotely. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.