CVE Tools
Track your stack

Qdpm

18 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Qdpm, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Qdpm CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Qdpm CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-031
2026-041
2026-050
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 18 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical211%
  • High844%
  • Medium844%

Latest CVEs

The 15 most recently published vulnerabilities affecting Qdpm.

  1. CVE-2019-25669qdPM 9.1 SQL Injection via search_by_extrafields Parameter8.2
  2. CVE-2018-25208qdPM 9.1 SQL Injection via filter_by Parameters8.2
  3. CVE-2023-45856qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI.9.8
  4. CVE-2023-45855qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.7.5
  5. CVE-2022-26180qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.8.8
  6. CVE-2020-19515qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.6.1
  7. CVE-2020-18468Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP r...5.4
  8. CVE-2020-26165qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.8.8
  9. CVE-2020-26166The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. T...5.4
  10. CVE-2020-11814A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites.5.4
  11. CVE-2020-11811In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arb...9.8
  12. CVE-2020-7246A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vuln...8.8
  13. CVE-2019-8391qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.6.1
  14. CVE-2019-8390qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.6.1
  15. CVE-2015-3884Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execu...8.8

Product grouping is registry-driven, with AI assist and human review. How it works