{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aquarkaqa_analytics/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:quarka:qa_analytics:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-114697"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["QA Analytics (n/a - 5.3.0.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["QuarkA"],"content_html":"\u003cp\u003eCVE-2026-114697 is a stored cross-site scripting (XSS) vulnerability in the QuarkA QA Analytics software. The flaw stems from improper neutralization of user-supplied input during web page generation. An attacker can leverage this vulnerability to inject malicious JavaScript into the application, which will subsequently execute in the browser of any user who views the injected content. This vulnerability impacts all versions from inception through 5.3.0.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript within the context of a victim session. This can lead to unauthorized actions performed on behalf of the user, session hijacking, or the theft of sensitive session tokens and data displayed within the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of QuarkA QA Analytics within the environment.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading to the latest patched version once released by QuarkA, as versions through 5.3.0.1 are confirmed vulnerable.\u003c/li\u003e\n\u003cli\u003eUntil a patch is applied, implement strict Content Security Policy (CSP) headers on the server hosting the application to restrict the execution of unauthorized inline scripts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests containing common XSS payloads (e.g., \u0026lt;script\u0026gt;, onload, onerror) directed at application input fields or comment sections.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T10:12:45Z","date_published":"2026-10-24T10:12:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-quarka-qa-xss/","summary":"QuarkA QA Analytics versions 5.3.0.1 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows attackers to inject and execute malicious scripts in the context of other users browsers.","title":"QuarkA QA Analytics: Stored Cross-Site Scripting (CVE-2026-114697)","url":"https://feed.craftedsignal.io/briefs/2026-10-quarka-qa-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:quarka:qa_analytics:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}