qdPM PHP Object Injection Vulnerability

qdPM is a free Web-based open source project management tool , written in symfony framework for small teams . qdPM 9.1 and earlier versions have PHP object injection vulnerabilities. An attacker can exploit this vulnerability by using timeReportActions::executeExport in...

CVE-2020-26165

CVE-2020-26165 affects qdPM through v9.1, where PHP object injection is possible via timeReportActions::executeExport due to using unserialize on user-supplied input. This vulnerability stems from unserialize on the export parameter, enabling injection attacks that can lead to code execution or o...

CVE-2020-26165: Deserialization of Untrusted Data

qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used...