Qbittorrent Client
Approved changes feed: RSS · Atom
cpe:2.3:a:qbittorrent:qbittorrent_client:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Qbittorrent (7e5db171-05a4-5ecd-822f-8f5f8598b23e) |
|---|---|
| Product | Qbittorrent Client (b0d2e9e3-56ca-5f99-b47f-17a0776b525a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-30801 |
vulnerable | 2026-06-08 06:04:41.181731 |
qBittorrent Web UI Default Credentials Lead to RCE
CRITICAL (9.8)
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
Published: 2023-10-10T13:46:46.775Z
Updated: 2025-11-21T16:15:48.956Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.