Vendors / qBittorrent Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 2
Exploited now qBittorrent records in CISA KEV No qBittorrent vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 70
qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
CVSS 3.1 HIGH 8.1· Network · No auth · No interaction · EPSS 0.03301 · Published 2024-11-02 · No fix listed CWE-295
Priority MEDIUM 53
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as…
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07913 · Published 2019-07-17 · No fix listed CWE-78
Priority MEDIUM 45
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01243 · Published 2023-10-10 · No fix listed CWE-1392
Priority LOW 32
The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functions by tampering the affected flag value of the config file a…
CVSS 3.0 HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00478 · Published 2019-05-09 · No fix listed CWE-287
Priority LOW 29
WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00857 · Published 2017-03-06 · No fix listed CWE-79
Priority LOW 28
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00673 · Published 2017-03-06 · No fix listed CWE-20
Priority LOW 25
qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00473 · Published 2025-07-18 · Fixed in 5.1.2 CWE-669
Open these records in search → All records by CVSS severity
2 2 3 0 0
THREATIST.IORead the docs