Advisories · Technology
expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker.
Every CVE that names expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Broken access control
- CVSS 4.3 Medium
Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Broken access control
- CVSS 4.9 Medium
Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- SQL injection
- CVSS 5.3 Medium
Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Other injection
- CVSS 6.5 Medium
Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- SQL injection
- CVSS 6.5 Medium
Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- SQL injection
- CVSS 6.5 Medium
Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Broken access control
- CVSS 4.3 Medium
Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- SQL injection
- CVSS 5.4 Medium
Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Cross-site request forgery (CSRF)
- CVSS 7.2 High
Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Broken access control
- CVSS 5.3 Medium
Quiz and Survey Master <= 8.0.4 - Improper Input Validation
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- CWE-20
- CVSS 7.2 High
Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- CWE-20