Qbittorrent
Approved changes feed: RSS · Atom
cpe:2.3:a:qbittorrent:qbittorrent:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Qbittorrent (7e5db171-05a4-5ecd-822f-8f5f8598b23e) |
|---|---|
| Product | Qbittorrent (9bd9ffe4-baa4-524d-b55a-cab9914b90ae) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/qbittorrent |
purl2cpe | 2026-06-01 10:15:53.960866 |
pkg:deb/ubuntu/qbittorrent |
purl2cpe | 2026-06-01 10:15:53.960869 |
pkg:github/qbittorrent/qbittorrent |
purl2cpe | 2026-06-01 10:15:53.960872 |
pkg:rpm/fedora/qbittorrent |
purl2cpe | 2026-06-01 10:15:53.960875 |
pkg:rpm/opensuse/qbittorrent |
purl2cpe | 2026-06-01 10:15:53.960878 |
pkg:sourceforge/qbittorrent |
purl2cpe | 2026-06-01 10:15:53.960881 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-54310 |
vulnerable | 2026-06-08 07:33:12.329268 |
Details available
MEDIUM (4)
qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp.
Published: 2025-07-18T00:00:00.000Z
Updated: 2025-07-22T15:01:34.591Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51774 |
vulnerable | 2026-06-08 06:52:12.806076 |
Details available
qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
Published: 2024-11-02T00:00:00.000Z
Updated: 2024-11-06T16:24:13.957Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-30801 |
vulnerable | 2026-06-08 06:04:41.182693 |
qBittorrent Web UI Default Credentials Lead to RCE
CRITICAL (9.8)
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
Published: 2023-10-10T13:46:46.775Z
Updated: 2025-11-21T16:15:48.956Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13640 |
vulnerable | 2026-06-08 05:12:52.243801 |
Details available
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
Published: 2019-07-17T21:07:47.000Z
Updated: 2024-10-31T01:29:55.954Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-6504 |
vulnerable | 2026-06-08 05:09:51.451579 |
Details available
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.
Published: 2017-03-06T02:00:00.000Z
Updated: 2024-08-05T15:33:20.225Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-6503 |
vulnerable | 2026-06-08 05:09:51.451170 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.