High severity8.8NVD Advisory· Published Jan 21, 2020· Updated Jun 17, 2026

CVE-2020-7246

Description

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Qdpm/Qdpm2 versions
cpe:2.3:a:qdpm:qdpm:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:qdpm:qdpm:*:*:*:*:*:*:*:*range: <=9.1
- (no CPE)range: <=9.1
qdPM/qdPMdescription

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/156063/qdPM-9.1-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/156571/qdPM-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/167264/qdPM-9.1-Remote-Code-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.htmlnvdExploitThird Party AdvisoryVDB Entry
docs.google.com/document/d/13ZZSm0DL1Ie6r_fU5ZdDKGZ4defFqiFXMG--zDo8S10/editnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.067
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000