Vulnerabilities

TI-2019-15722 CVE-2019-25669 · GHSA-jqv8-r4c5-xvcv

qdPM 9.1 SQL Injection via search_by_extrafields Parameter

HIGH 77

qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00317 Published 2026-04-05 No fix listed CWE-89

TI-2018-15433 CVE-2018-25208 · GHSA-xfmc-rj6p-7fpg

qdPM 9.1 SQL Injection via filter_by Parameters

HIGH 77

qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00343 Published 2026-03-26 No fix listed CWE-89

TI-2023-24613 CVE-2023-45856 · GHSA-5mmq-8hjw-gc3g

qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit…

HIGH 82

qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01747 Published 2023-10-14 No fix listed CWE-434

TI-2023-24612 CVE-2023-45855 · GHSA-cr2w-gfw6-cgj8

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.

HIGH 72

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03718 Published 2023-10-14 No fix listed CWE-22

TI-2022-09618 CVE-2022-26180 · GHSA-9v79-hrc5-gvgm

qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.

MEDIUM 44

qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0375 Published 2022-04-08 No fix listed CWE-352

TI-2020-13640 CVE-2020-19515 · GHSA-5j3m-26vx-5q73

qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.

LOW 31

qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01789 Published 2021-09-09 No fix listed CWE-79

TI-2020-13406 CVE-2020-18468 · GHSA-532f-v327-35gw

Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in…

LOW 25

Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/ind…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00413 Published 2021-08-26 No fix listed CWE-79

TI-2020-15998 CVE-2020-26165 · GHSA-q62r-wv6v-9494

qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in…

MEDIUM 43

qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02532 Published 2020-12-31 No fix listed CWE-502

TI-2020-15999 CVE-2020-26166 · GHSA-m583-fc3c-p6gh

The file upload functionality in qdPM 9.1 doesn't check the file description, which…

LOW 26

The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00849 Published 2020-10-05 No fix listed CWE-79

TI-2020-09486 CVE-2020-11814 · GHSA-5px2-pxjc-8255

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a…

LOW 26

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00996 Published 2020-04-16 No fix listed CWE-74

TI-2020-09483 CVE-2020-11811 · GHSA-534r-p456-vxp5

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the…

MEDIUM 48

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02998 Published 2020-04-16 No fix listed CWE-434

TI-2020-05853 CVE-2020-7246 · GHSA-c89p-wjj4-mr4g

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.

HIGH 79

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.83235 Published 2020-01-21 No fix listed CWE-22

TI-2019-06022 CVE-2019-8391 · GHSA-rc27-h258-8jcj

qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.

LOW 33

qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.03342 Published 2019-05-14 No fix listed CWE-79

TI-2019-06021 CVE-2019-8390 · GHSA-8jhf-f6ww-f9rj

qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.

LOW 39

qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.09836 Published 2019-05-14 No fix listed CWE-79

TI-2015-03299 CVE-2015-3884 · GHSA-v3rx-h663-g7gx

Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4)…

MEDIUM 53

Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by up…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.14399 Published 2017-03-17 No fix listed CWE-434

TI-2015-03298 CVE-2015-3883 · GHSA-5mjw-pmfh-7vh5

Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to…

LOW 29

Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application"…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00797 Published 2017-03-17 No fix listed CWE-79

TI-2015-03297 CVE-2015-3882 · GHSA-mv83-c55q-p9p2

qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to…

LOW 26

qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01178 Published 2017-03-17 No fix listed CWE-200

TI-2015-03296 CVE-2015-3881 · GHSA-g2c8-c2j8-3vp6

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive…

LOW 36

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.ym…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01545 Published 2017-03-17 No fix listed CWE-200

Vulnerabilities

Filters