Qdpm is a modestly represented project management application that sits among more prominent products in the vulnerability landscape, with its exposure centered in a single product line. Vulnerabilities affecting the application skew toward serious outcomes and frequently acquire public exploit code; the recurring weakness classes—cross-site scripting, unrestricted file uploads, sensitive information exposure, path traversal, and SQL injection—reflect the input-handling and access-control demands of web-facing applications. Defenders should prioritize patching for this application in networked environments and treat it as a web-tier risk; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Qdpm over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-7246HIGH A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a pa | Jan 21, 2020 | 8.8 | 83 | NO | YES |
CVE-2015-3884HIGH Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote a | Mar 17, 2017 | 8.8 | 41 | NO | YES |
CVE-2022-26180HIGH qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. | Apr 8, 2022 | 8.8 | 40 | NO | YES |
CVE-2019-8390MEDIUM qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. | May 14, 2019 | 6.1 | 37 | NO | YES |
CVE-2023-45855HIGH qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. | Oct 14, 2023 | 7.5 | 33 | NO | YES |
CVE-2020-11811CRITICAL In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker c | Apr 16, 2020 | 9.8 | 32 | NO | NO |
CVE-2020-19515MEDIUM qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php. | Sep 9, 2021 | 6.1 | 31 | NO | YES |
CVE-2023-45856CRITICAL qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. | Oct 14, 2023 | 9.8 | 30 | NO | NO |
CVE-2019-25669HIGH qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers | Apr 5, 2026 | 8.2 | 27 | NO | NO |
CVE-2020-26165HIGH qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used. | Dec 31, 2020 | 8.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Qdpm.
Media articles that mention a CVE ID that affects a product developed by Qdpm — matched by CVE ID, not by vendor name.