Qdpm
Products
1- 17 CVEs
Recent CVEs
17| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-3884 | Hig | 0.61 | 8.8 | 0.14 | Mar 17, 2017 | Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing… | ||
| CVE-2019-25669 | Hig | 0.53 | 8.2 | 0.00 | Apr 5, 2026 | qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to… | ||
| CVE-2018-25208 | Hig | 0.53 | 8.2 | 0.00 | Mar 26, 2026 | qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted… | ||
| CVE-2015-3881 | Hig | 0.49 | 7.5 | 0.02 | Mar 17, 2017 | Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml. | ||
| CVE-2015-3883 | Med | 0.40 | 6.1 | 0.01 | Mar 17, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application" on index.php/configuration; (3) a new project name on… | ||
| CVE-2015-3882 | Med | 0.35 | 5.3 | 0.01 | Mar 17, 2017 | qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message. | ||
| CVE-2020-7246 | 0.10 | — | 0.83 | Jan 21, 2020 | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of… | |||
| CVE-2023-45855 | 0.06 | — | 0.03 | Oct 14, 2023 | qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. | |||
| CVE-2022-26180 | 0.03 | — | 0.04 | Apr 8, 2022 | qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. | |||
| CVE-2019-8391 | 0.03 | — | 0.03 | May 14, 2019 | qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. | |||
| CVE-2019-8390 | 0.03 | — | 0.09 | May 14, 2019 | qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. | |||
| CVE-2023-45856 | 0.01 | — | 0.01 | Oct 14, 2023 | qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. | |||
| CVE-2020-19515 | 0.00 | — | 0.02 | Sep 9, 2021 | qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php. | |||
| CVE-2020-18468 | 0.00 | — | 0.00 | Aug 26, 2021 | Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration. | |||
| CVE-2020-26165 | 0.00 | — | 0.03 | Dec 31, 2020 | qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used. | |||
| CVE-2020-26166 | 0.00 | — | 0.01 | Oct 5, 2020 | The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task. | |||
| CVE-2020-11811 | 0.00 | — | 0.03 | Apr 16, 2020 | In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file. |
- risk 0.61cvss 8.8epss 0.14
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing…
- risk 0.53cvss 8.2epss 0.00
qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to…
- risk 0.53cvss 8.2epss 0.00
qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted…
- risk 0.49cvss 7.5epss 0.02
Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application" on index.php/configuration; (3) a new project name on…
- risk 0.35cvss 5.3epss 0.01
qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
- CVE-2020-7246Jan 21, 2020risk 0.10cvss —epss 0.83
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of…
- CVE-2023-45855Oct 14, 2023risk 0.06cvss —epss 0.03
qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.
- CVE-2022-26180Apr 8, 2022risk 0.03cvss —epss 0.04
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
- CVE-2019-8391May 14, 2019risk 0.03cvss —epss 0.03
qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
- CVE-2019-8390May 14, 2019risk 0.03cvss —epss 0.09
qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.
- CVE-2023-45856Oct 14, 2023risk 0.01cvss —epss 0.01
qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.
- CVE-2020-19515Sep 9, 2021risk 0.00cvss —epss 0.02
qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.
- CVE-2020-18468Aug 26, 2021risk 0.00cvss —epss 0.00
Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration.
- CVE-2020-26165Dec 31, 2020risk 0.00cvss —epss 0.03
qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.
- CVE-2020-26166Oct 5, 2020risk 0.00cvss —epss 0.01
The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.
- CVE-2020-11811Apr 16, 2020risk 0.00cvss —epss 0.03
In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file.