qdPM cross-site scripting vulnerability (CNVD-2020-64598)

qdPM is a Web-based open source project management tool . A security vulnerability exists in qdPM version 9.1, which stems from the file upload feature not checking the file description, and can be exploited by an attacker to inject web scripts or HTML via attachment message parameters XSS...