211 matches found
qBittorrent Web UI Panel - Detect
Detects qBittorrent Web UI Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects qBittorrent Web UI Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'qBittorrent Web UI Panel - Detect',...
Astra Linux – Vulnerability in qBittTorrent
All versions of the qBittorrent client up to 4.5.5 use default credentials when the web user interface is enabled. Administrators are not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...
Astra Linux – Vulnerability in qBittTorrent
qBittorrent versions before 5.0.1 continue to use HTTPS URLs, even after certificate validation errors occur...
Astra Linux – Vulnerability in qBittTorrent
qBittorrent versions before 5.1.2 do not prevent access to a local file that is referenced in a link URL. This issue affects rsswidget.cpp and searchjobwidget.cpp...
MSC-2025-8437
@ctrl/qbittorrent package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all...
MSC-2025-8397
@ctrl/qbittorrent package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all...
MSC-2025-7974
@ctrl/qbittorrent package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all...
MSC-2025-7975
@ctrl/qbittorrent package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all...
PT-2026-40330
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the X-Forwarded-For header as the client IP. That entr...
PT-2026-40331
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials. When DisableAuthForLocalAddresses ...
SUSE CVE-2026-30924
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a...
CVE-2026-30924
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a...
CVE-2026-30924
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a...
UBUNTU-CVE-2026-30924
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a...
CVE-2026-30924
CVE-2026-30924 affects the web interface for managing qBittorrent instances (qui). Versions 1.14.1 and earlier are reported to have a permissive CORS policy that reflects arbitrary origins and returns Access-Control-Allow-Credentials: true, enabling a logged-in user’s session to be leveraged by a...
CVE-2026-30924 qui CORS Misconfiguration: Arbitrary Origins Trusted
qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a...
PT-2026-25386
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. From 2.7.0 to 2.8.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by...
Advisory ROSA-SA-2026-3125
Software: qbittorrent 4.6.7 OS: ROSA-CHROME unaffected versions = qbittorrent-4.6.7-2 affected versions qbittorrent-4.6.7-2 CVE-ID: CVE-2025-54310 BDU-ID: 2025-11251 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the cross-platform BitTorrent client qBittorrent is related to the lack of validatio...
CVE-2017-12778
The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functions by tampering the affected flag value of the config file at the C:\Users\Roaming\qBittorrent pathname. The attacker must change the...
