汇总 qdpm 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
历史漏洞主要涉及 跨站脚本与路径处理缺陷 等问题，部分漏洞可能导致 会话劫持，并影响 生产负载与软件部署 相关场景。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2019-25669 | qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors and extract database information. | [email protected] | 8.8 | 0.31% | 2026-04-05 | 2026-06-16 |
| CVE-2018-25208 | qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data. | [email protected] | 8.8 | 0.34% | 2026-03-26 | 2026-06-16 |
| CVE-2023-45856 | qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. | [email protected] | 9.8 | 1.40% | 2023-10-14 | 2026-06-17 |
| CVE-2023-45855 | qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. | [email protected] | 7.5 | 3.33% | 2023-10-14 | 2026-06-17 |
| CVE-2022-26180 | qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. | [email protected] | 8.8 | 3.75% | 2022-04-08 | 2026-06-17 |
| CVE-2020-19515 | qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php. | [email protected] | 6.1 | 1.79% | 2021-09-09 | 2026-06-16 |
| CVE-2020-18468 | Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration. | [email protected] | 5.4 | 0.35% | 2021-08-26 | 2026-06-16 |
| CVE-2020-26165 | qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used. | [email protected] | 8.8 | 2.50% | 2020-12-31 | 2026-06-16 |
| CVE-2020-26166 | The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task. | [email protected] | 5.4 | 0.84% | 2020-10-05 | 2026-06-16 |
| CVE-2020-11814 | A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious websites. | [email protected] | 5.4 | 1.00% | 2020-04-16 | 2026-06-16 |
| CVE-2020-11811 | In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file. | [email protected] | 9.8 | 3.00% | 2020-04-16 | 2026-06-16 |
| CVE-2020-7246 | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884. | [email protected] | 8.8 | 83.23% | 2020-01-21 | 2026-06-16 |
| CVE-2019-8391 | qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. | [email protected] | 6.1 | 3.34% | 2019-05-14 | 2026-06-16 |
| CVE-2019-8390 | qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. | [email protected] | 6.1 | 9.84% | 2019-05-14 | 2026-06-16 |
| CVE-2015-3884 | Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/. | [email protected] | 8.8 | 14.40% | 2017-03-17 | 2026-06-16 |
| CVE-2015-3883 | Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application" on index.php/configuration; (3) a new project name on index.php/projects; (4) the task name on index.php/tasks; (5) ticket name on index.php/tickets; (6) discussion name on index.php/discussions; (7) report name on index.php/projectReports; or (8) event name on index.php/schedule | [email protected] | 6.1 | 0.80% | 2017-03-17 | 2026-06-16 |
| CVE-2015-3882 | qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message. | [email protected] | 5.3 | 1.18% | 2017-03-17 | 2026-06-16 |
| CVE-2015-3881 | Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml. | [email protected] | 7.5 | 1.54% | 2017-03-17 | 2026-06-16 |