Cpe:2.3:a:quarka:qa_analytics:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aquarkaqa_analytics/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 10:12:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgQuarkA QA Analytics: Stored Cross-Site Scripting (CVE-2026-114697)https://feed.craftedsignal.io/briefs/2026-10-quarka-qa-xss/Sat, 24 Oct 2026 10:12:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-quarka-qa-xss/QuarkA QA Analytics versions 5.3.0.1 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows attackers to inject and execute malicious scripts in the context of other users browsers.CVE-2026-114697 is a stored cross-site scripting (XSS) vulnerability in the QuarkA QA Analytics software. The flaw stems from improper neutralization of user-supplied input during web page generation. An attacker can leverage this vulnerability to inject malicious JavaScript into the application, which will subsequently execute in the browser of any user who views the injected content. This vulnerability impacts all versions from inception through 5.3.0.1.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the context of a victim session. This can lead to unauthorized actions performed on behalf of the user, session hijacking, or the theft of sensitive session tokens and data displayed within the application.

Recommendation

  • Identify all instances of QuarkA QA Analytics within the environment.
  • Prioritize upgrading to the latest patched version once released by QuarkA, as versions through 5.3.0.1 are confirmed vulnerable.
  • Until a patch is applied, implement strict Content Security Policy (CSP) headers on the server hosting the application to restrict the execution of unauthorized inline scripts.
  • Monitor web server logs for suspicious POST requests containing common XSS payloads (e.g., <script>, onload, onerror) directed at application input fields or comment sections.
]]>highadvisory