CVE-2019-25669 | High | 8.2 | 2026-04-05 | qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[]… |
CVE-2018-25208 | High | 8.2 | 2026-03-26 | qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by… |
CVE-2023-45856 | Critical | 9.8 | 2023-10-14 | qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. |
CVE-2023-45855 | High | 7.5 | 2023-10-14 | qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. |
CVE-2022-26180 | High | 8.8 | 2022-04-08 | qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. |
CVE-2020-19515 | Medium | 6.1 | 2021-09-09 | qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php. |
CVE-2020-18468 | Medium | 5.4 | 2021-08-26 | Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name… |
CVE-2020-26165 | High | 8.8 | 2020-12-31 | qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unseri… |
CVE-2020-26166 | Medium | 5.4 | 2020-10-05 | The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the… |
CVE-2020-11814 | Medium | 5.4 | 2020-04-16 | A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites. |
CVE-2020-11811 | Critical | 9.8 | 2020-04-16 | In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After… |
CVE-2020-7246 | High | 8.8 | 2020-01-21 | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionalit… |
CVE-2019-8391 | Medium | 6.1 | 2019-05-14 | qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. |
CVE-2019-8390 | Medium | 6.1 | 2019-05-14 | qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. |
CVE-2015-3884 | High | 8.8 | 2017-03-17 | Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdP… |
CVE-2015-3883 | Medium | 6.1 | 2017-03-17 | Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] para… |
CVE-2015-3882 | Medium | 5.3 | 2017-03-17 | qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in a… |
CVE-2015-3881 | High | 7.5 | 2017-03-17 | Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) cor… |