Advisories · Technology
expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker.
Every CVE that names expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- Code injection
- CVSS 7.2 High
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- SQL injection
- CVSS 6.4 Medium
Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- SQL injection