Vulnerabilities > Qdpm > Qdpm > 9.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-09-09 | CVE-2020-19515 | Cross-site Scripting vulnerability in Qdpm 9.1 qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php. | 4.3 |
| 2021-08-26 | CVE-2020-18468 | Cross-site Scripting vulnerability in Qdpm 9.1 Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration. | 3.5 |
| 2020-12-31 | CVE-2020-26165 | Code Injection vulnerability in Qdpm 8.3/9.0/9.1 qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used. | 6.5 |
| 2020-10-05 | CVE-2020-26166 | Cross-site Scripting vulnerability in Qdpm 9.1 The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. | 3.5 |
| 2020-04-16 | CVE-2020-11814 | Injection vulnerability in Qdpm 9.1 A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites. | 5.8 |
| 2020-04-16 | CVE-2020-11811 | Unrestricted Upload of File with Dangerous Type vulnerability in Qdpm 9.1 In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. | 10.0 |
| 2020-01-21 | CVE-2020-7246 | Unrestricted Upload of File with Dangerous Type vulnerability in Qdpm 8.3/9.0/9.1 A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. | 8.8 |
| 2019-05-14 | CVE-2019-8391 | Cross-site Scripting vulnerability in Qdpm 9.1 qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. | 4.3 |
| 2019-05-14 | CVE-2019-8390 | Cross-site Scripting vulnerability in Qdpm 9.1 qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. | 4.3 |
| 2017-03-17 | CVE-2015-3884 | Unrestricted Upload of File with Dangerous Type vulnerability in Qdpm 8.3/9.0/9.1 Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/. | 8.8 |