High severity8.8NVD Advisory· Published Mar 17, 2017· Updated Jun 17, 2026

CVE-2015-3884

Description

Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Qdpm/Qdpm2 versions
cpe:2.3:a:qdpm:qdpm:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:qdpm:qdpm:*:*:*:*:*:*:*:*range: <=9.1
- (no CPE)range: <8.3

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.htmlnvdExploitThird Party AdvisoryVDB Entry
rossmarks.uk/whitepapers/qdPM_8.3.txtnvdExploitThird Party Advisory
rossmarks.uk/portfolio.phpnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.012
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000