CVE-2023-47253

CVE-2023-47253 CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', 概念実証（POC） URLにアクセスし、PHPコードを"gridValoresPopHidden"パラメータに含めて送信するだけです。 研究者 https://www.linkedin.com/in/xvinicius/...

CVE-2024-44849

CVE-2024-44849 著者: Extencil [email protected] CVE-2024-44849 は、Qualitor 8.24 以前の全バージョンに影響する重大な RCE 脆弱性です。Qualitor ウェブサイト このプログラムを、相互の同意なしにいかなる企業やシステムへの攻撃・侵害に使用することは違法です。本コードの作成者は、本ソフトウェアを使用して行われた不正使用や違法行為について一切の責任を負いません。これは教育目的および許可されたテストのためにのみ意図されています。セキュリティ評価を実施する前に、必ず適切な許可を得てください。...

Qualitor <= 8.20 - Remote Code Execution

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter. id: CVE-2023-47253 info: name: Qualitor = 8.20 - Remote Code Execution author: s4e-io severity: critical description: |...

Qualitor <= 8.24 - Remote Code Execution

Qualitor up to 8.24 is vulnerable to Remote Code Execution RCE via Arbitrary File Upload in checkAcesso.php. id: CVE-2024-44849 info: name: Qualitor = 8.24 - Remote Code Execution author: s4e-io severity: critical description: | Qualitor up to 8.24 is vulnerable to Remote Code Execution RCE via...

Qualitor <= v8.24 - Server-Side Request Forgery

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery SSRF via the component /request/viewValidacao.php. id: CVE-2024-48360 info: name: Qualitor = v8.24 - Server-Side Request Forgery author: s4e-io severity: high description: | Qualitor v8.24 was discovered to contain a Server-Si...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', 概念実証（POC） 「gridValoresPopHidden」パラメータにPHPコードを入れてURLにアクセスするだけです。 調査 https://www.linkedin.com/in/xvinicius/...

CVE-2024-48359

CVE-2024-48359 - Qualitor = v8.24 未認証RCE PoC CVE-2024-48359 | Qualitor = v8.24 RCE 説明 Qualitorはビジネスプロセス管理のためのプラットフォームであり、このシステムはブラジルの様々な企業に導入されています。Google dorkingを使用するだけで簡単に特定できます。 私たちのチームは、システムコマンドのリモート実行を可能にするリモートコード実行（RCE）の影響を受けやすいアプリケーションの脆弱性を特定しました。 これはCVE-2023-47253修正のバイパスです。 概念実証（POC）...

CVE-2024-48360

CVE-2024-48360 | Qualitor = v8.24 認証なしSSRF CVE-2024-48360 | Qualitor = v8.24 認証なしSSRF 説明 Qualitorはビジネスプロセス管理のためのプラットフォームであり、このシステムはブラジルのさまざまな企業に導入されています。Googleダーキングを使用するだけで簡単に特定できます。 私たちのチームは、SSRFの影響を受けやすいアプリケーションの脆弱性を特定しました。これにより、内部システム/ポートを列挙することが可能になります。 概念実証（POC） Qualitor v8.24には、コンポーネント...

VulnCheck KEV: CVE-2023-47253

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter...

CVE-2025-14580

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

CVE-2025-14580

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

CVE-2025-14580

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

EUVD-2025-203115

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

CVE-2025-14580

Summary: CVE-2025-14580 affects Qualitor up to 8.24.73. The vulnerability lies in an unknown function in /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php where manipulation of the cdscript argument enables cross-site scripting. It can be exploited remotely and has been publicly...

CVE-2025-14580 Qualitor viewDocumento.php cross site scripting

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

CVE-2025-14580 Qualitor viewDocumento.php cross site scripting

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

PT-2025-50978

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the...

Qualitor 代码注入漏洞

Qualitor is a managed service process and centralized service platform from Qualitor, Inc. A code injection vulnerability exists in Qualitor 8.24.73 and earlier versions, which stems from incorrect manipulation of the parameter cdscript in the file...

CVE-2025-13792

A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento/request/getResumo.php. Performing a manipulation of the argument passageiros results in code injection. Remote exploitation of the attack...

EUVD-2025-199935

A security flaw has been discovered in Qualitor 8.20/8.24. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento/request/getResumo.php. Performing manipulation of the argument passageiros results in code injection. Remote exploitation of the attack is possible. T...