Qdocs develops school and hospital management platforms that handle sensitive institutional and personal data, presenting a focused but high-value attack surface centered on web-based administrative applications. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and recur through application-layer input-handling and file-upload weaknesses including cross-site scripting, SQL injection, and unrestricted file uploads that are characteristic of data-intensive web platforms. Defenders should prioritize this vendor's updates given the sensitivity of student and patient information at stake; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Qdocs over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-5495CRITICAL A vulnerability was found in QDocs Smart School 6.4.1. It has been classified as critical. This affects an unknown part of the file /course/filterRecords/ of the component HTTP POS | Oct 10, 2023 | 9.8 | 25 | NO | NO |
CVE-2025-60500HIGH QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusi | Oct 21, 2025 | 7.2 | 24 | NO | NO |
CVE-2024-8784HIGH A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of the file /user/chat/my | Sep 13, 2024 | 8.8 | 24 | NO | NO |
CVE-2025-41107MEDIUM Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admission', wich affects | Nov 10, 2025 | 5.4 | 21 | NO | NO |
CVE-2024-34240MEDIUM QDOCS Smart School 7.0.0 is vulnerable to Cross Site Scripting (XSS) resulting in arbitrary code execution in admin functions related to adding or updating records. | May 21, 2024 | 6.1 | 18 | NO | NO |
CVE-2020-36011MEDIUM A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, | Jan 26, 2021 | 4.8 | 18 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Qdocs.
Media articles that mention a CVE ID that affects a product developed by Qdocs — matched by CVE ID, not by vendor name.