CVE-2020-18468

CVE-2020-18468 affects qdPM 9.1. An XSS exists in the Login Page heading field under the General menu, exploitable via a crafted website name through an authenticated POST to /qdPM_9.1/index.php/configuration. The issue stems from insufficient input validation on the heading, enabling client-side...