CVE-2019-25669

qdPM 9.1 is affected by an SQL injection vulnerability in the search_by_extrafields[] parameter. An attacker can craft malicious values and send POST requests to the users endpoint to trigger SQL syntax errors and exfiltrate database information. The issue arises from unvalidated input used in da...

EUVD-2020-18790

Malware in sbrugna...

EUVD-2020-4153

Malware in sbrugna...

CVE-2022-26180

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

CVE-2020-7246

A remote code execution RCE vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature, allowing bypass of .htaccess protection...

CVE-2020-11814

A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites...

CVE-2020-19515

qdPM V9.1 is vulnerable to Cross Site Scripting XSS via qdPM\install\modules\databaseconfig.php...

CVE-2020-19515

qdPM V9.1 is vulnerable to Cross Site Scripting XSS via qdPM\install\modules\databaseconfig.php...

qdPM PHP Object Injection Vulnerability

qdPM is a free Web-based open source project management tool , written in symfony framework for small teams . qdPM 9.1 and earlier versions have PHP object injection vulnerabilities. An attacker can exploit this vulnerability by using timeReportActions::executeExport in...

CVE-2020-26165

qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used...

qdPM Cross-Site Scripting Vulnerability

qdPM is a free , open source based on Symfony framework using PHP and MySQL development project management system . A cross-site scripting vulnerability exists in qdPM version 8.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of parameters ...

qdPM Information Disclosure Vulnerability (CNVD-2017-03454)

qdPM is a free , open source based on Symfony framework using PHP and MySQL development project management system . An information disclosure vulnerability exists in qdPM version 8.3. A remote attacker can exploit this vulnerability by sending an invalid ID value to index.php/users/info/id/ID to...