qdPM Remote Code Execution

!/usr/bin/python ------------------------------------------------------------------------------------- Title: qdPM Webshell Upload + RCE Exploit qdPMv9.1 and below CVE-2020-7246 Author: Tobin Shields @TobinShields Description: This is an exploit to automatically upload a PHP web shell to the qdPM...

qdPM 9.1 - Remote Code Execution

Exploit Title: qdPM 9.1 - Remote Code Execution Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Date: 2020-01-22 Exploit Author: Rishal Dwivedi Loginsoft Vendor Homepage: http://qdpm.net/ Software Link: http://qdpm.net/download-qdpm-free-project-management Version: =1.9.1 Tested on:...

qdPM 9.1 - Remote Code Execution

qdPM 9.1 - Remote Code Execution Exploit Title: qdPM 9.1 - Remote Code Execution Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Date: 2020-01-22 Exploit Author: Rishal Dwivedi Loginsoft Vendor Homepage: http://qdpm.net/ Software Link: http://qdpm.net/download-qdpm-free-project-managemen...

qdPM 9.1 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: qdPM 9.1 - Remote Code Execution Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Exploit Author: Rishal Dwivedi Loginsoft Vendor Homepage: http://qdpm.net/ Software Link:...

qdPM 9.1 Remote Code Execution

Exploit Title: qdPM 9.1 - Remote Code Execution Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net Date: 2020-01-22 Exploit Author: Rishal Dwivedi Loginsoft Vendor Homepage: http://qdpm.net/ Software Link: http://qdpm.net/download-qdpm-free-project-management Version: =1.9.1 Tested on:...

CVE-2020-7246

A remote code execution RCE vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature, allowing bypass of .htaccess protection...

Path traversal

A remote code execution RCE vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature, allowing bypass of .htaccess protection...

CVE-2020-7246

A remote code execution RCE vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature, allowing bypass of .htaccess protection...

CVE-2020-7246

CVE-2020-7246 affects qdPM

CVE-2020-7246

A remote code execution RCE vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature, allowing bypass of .htaccess protection...

CVE-2019-8391

qdPM 9.1 suffers from Cross-site Scripting XSS via configuration?type=XSS parameter...

CVE-2019-8391

qdPM 9.1 suffers from Cross-site Scripting XSS via configuration?type=XSS parameter...

Cross site scripting

qdPM 9.1 suffers from Cross-site Scripting XSS via configuration?type=XSS parameter...

Cross site scripting

qdPM 9.1 suffers from Cross-site Scripting XSS in the searchkeywords parameter...

CVE-2019-8390

qdPM 9.1 suffers from Cross-site Scripting XSS in the searchkeywords parameter...

CVE-2019-8390

qdPM 9.1 suffers from Cross-site Scripting XSS in the searchkeywords parameter...

CVE-2019-8391

qdPM 9.1 suffers from Cross-site Scripting XSS via configuration?type=XSS parameter...

CVE-2019-8391

CVE-2019-8391 affects qdPM 9.1 with a Cross-site Scripting (XSS) flaw exploitable via the configuration page parameter type (type=[XSS]). The vulnerability arises from unsafely handling the type parameter, enabling script injection in web pages accessed by users. Public exploit examples exist (e....

CVE-2019-8390

qdPM 9.1 suffers from Cross-site Scripting XSS in the searchkeywords parameter...

CVE-2019-8390

qdPM 9.1 is affected by Cross-site Scripting in the search[keywords] parameter. The root cause is inadequate sanitization of user input in the search field, enabling an attacker to inject and execute script code in a victim’s browser. Reported impact includes potential session hijacking, defaceme...