QuarkA QA Analytics: Stored Cross-Site Scripting (CVE-2026-114697)

CVE-2026-114697 is a stored cross-site scripting (XSS) vulnerability in the QuarkA QA Analytics software. The flaw stems from improper neutralization of user-supplied input during web page generation. An attacker can leverage this vulnerability to inject malicious JavaScript into the application, which will subsequently execute in the browser of any user who views the injected content. This vulnerability impacts all versions from inception through 5.3.0.1.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the context of a victim session. This can lead to unauthorized actions performed on behalf of the user, session hijacking, or the theft of sensitive session tokens and data displayed within the application.

Recommendation

• Identify all instances of QuarkA QA Analytics within the environment.
• Prioritize upgrading to the latest patched version once released by QuarkA, as versions through 5.3.0.1 are confirmed vulnerable.
• Until a patch is applied, implement strict Content Security Policy (CSP) headers on the server hosting the application to restrict the execution of unauthorized inline scripts.
• Monitor web server logs for suspicious POST requests containing common XSS payloads (e.g., <script>, onload, onerror) directed at application input fields or comment sections.