CVE-2015-3884
🗓️ 17 Mar 2017 14:00:00Reported by mitreType 
cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 100 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | qdPM 9.1 Authenticated Shell Upload Exploit | 29 Sep 202200:00 | – | zdt |
 | CVE-2015-3884 | 29 May 201815:50 | – | circl |
 | qdPM Arbitrary File Upload Vulnerability | 21 Mar 201700:00 | – | cnvd |
 | CVE-2015-3884 | 17 Mar 201714:00 | – | cvelist |
 | EUVD-2015-3919 | 7 Oct 202500:30 | – | euvd |
 | qdPM v7 Arbitrary PHP File Upload Vulnerability | 14 Jun 201200:00 | – | metasploit |
 | CVE-2015-3884 | 17 Mar 201714:59 | – | nvd |
 | qdPM 9.1 Authenticated Shell Upload | 29 Sep 202200:00 | – | packetstorm |
 | Unrestricted file upload | 17 Mar 201714:59 | – | prion |
| Path traversal | 21 Jan 202014:15 | – | prion |
10
| Source | Link |
|---|---|
| rossmarks | www.rossmarks.uk/portfolio.php |
| rossmarks | www.rossmarks.uk/whitepapers/qdPM_8.3.txt |
| packetstormsecurity | www.packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.html |
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| users[photo_preview] | nested | /index.php/myAccount/update | Unrestricted file upload via qdPM profile photo feature (CVE-2015-3884). Attacker uploads a PHP payload by manipulating nested form fields and accesses the uploaded file in uploads/users/ to execute code. | CWE-434 |
| users[photo] | nested | /index.php/myAccount/update | Unrestricted file upload via qdPM profile photo feature (CVE-2015-3884). Attacker uploads a PHP payload by manipulating nested form fields and accesses the uploaded file in uploads/users/ to execute code. | CWE-434 |
| users[photo_preview] | nested | /index.php/myAccount/update | Authenticated arbitrary PHP file upload (RCE) in qdPM 9.1 and below via path traversal in the profile photo feature (CVE-2020-7246). Bypasses .htaccess protection using path traversal. | CWE-434 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 00:26Current
8.9High risk
Vulners AI Score8.9
CVSS 26.5
CVSS 3.18.8
EPSS0.14399