Qdpm vulnerabilities

Products

• Qdpm 18

Newest

• qdpm qdPM 9.1 SQL Injection via search_by_extrafields Parameter CVE-2019-25669 8.8 HighApril 5, 2026
• qdpm qdPM 9.1 SQL Injection via filter_by Parameters CVE-2018-25208 8.8 HighMarch 26, 2026
• qdpm qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to... CVE-2023-45856 9.8 CriticalOctober 14, 2023
• qdpm qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. CVE-2023-45855 7.5 HighOctober 14, 2023
• qdpm qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. CVE-2022-26180 Public exploit 8.8 HighApril 8, 2022
• qdpm qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php. CVE-2020-19515 6.1 MediumSeptember 9, 2021
• qdpm Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the... CVE-2020-18468 5.4 MediumAugust 26, 2021
• qdpm qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps... CVE-2020-26165 8.8 HighDecember 31, 2020
• qdpm The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote... CVE-2020-26166 5.4 MediumOctober 5, 2020
• qdpm A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular... CVE-2020-11814 5.4 MediumApril 16, 2020
• qdpm In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add... CVE-2020-11811 9.8 CriticalApril 16, 2020
• qdpm A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can... CVE-2020-7246 Public exploit EPSS 83.2% 8.8 HighJanuary 21, 2020
• qdpm qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. CVE-2019-8391 Public exploit 6.1 MediumMay 14, 2019
• qdpm qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. CVE-2019-8390 Public exploit 6.1 MediumMay 14, 2019
• qdpm Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets... CVE-2015-3884 Public exploit EPSS 14.4% 8.8 HighMarch 17, 2017
• qdpm Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject... CVE-2015-3883 6.1 MediumMarch 17, 2017
• qdpm qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index... CVE-2015-3882 5.3 MediumMarch 17, 2017
• qdpm Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information... CVE-2015-3881 7.5 HighMarch 17, 2017