GCVE - cpe:2.3:a:qdpm:qdpm:9.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:qdpm:qdpm:9.2:*:*:*:*:*:*:*

part: a version: 9.2 update: *

Vendor	Qdpm (`873e6420-9d31-5951-9fbf-08e4cf044ff9`)
Product	Qdpm (`12bdb714-5b9b-5969-93c8-edbcae85fed1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/dodiksunaryo/qdpm`	purl2cpe	2026-06-01 10:17:36.934022
`pkg:sourceforge/qdpm`	purl2cpe	2026-06-01 10:17:36.934023

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-45856`	vulnerable	2026-06-08 06:12:43.466510	Details available qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. Published: 2023-10-14T00:00:00.000Z Updated: 2024-09-17T13:37:29.881Z Open on db.gcve.eu Reference links https://qdpm.net https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/RCE.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45855`	vulnerable	2026-06-08 06:12:43.466058	Details available qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. Published: 2023-10-14T00:00:00.000Z Updated: 2024-09-17T13:39:04.424Z Open on db.gcve.eu Reference links https://github.com/SunshineOtaku/Report-CVE/blob/main/qdPM/9.2/Directory%20Traversal.md https://qdpm.net	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-26180`	vulnerable	2026-06-08 05:41:50.719021	Details available qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. Published: 2022-04-08T20:08:52.000Z Updated: 2024-08-03T04:56:37.840Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/166630/qdPM-9.2-Cross-Site-Request-Forgery.html https://www.exploit-db.com/exploits/50854	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-25669`	vulnerable	2026-06-08 05:13:42.746624	qdPM 9.1 SQL Injection via search_by_extrafields Parameter HIGH (8.2) qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors and extract database information. Published: 2026-04-05T20:45:22.800Z Updated: 2026-04-06T15:27:33.520Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/46387 http://qdpm.net http://qdpm.net/download-qdpm-free-project-management https://www.vulncheck.com/advisories/qdpm-sql-injection-via-search-by-extrafields-parameter	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-25208`	vulnerable	2026-06-08 05:11:29.578006	qdPM 9.1 SQL Injection via filter_by Parameters HIGH (8.2) qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data. Published: 2026-03-26T11:39:54.728Z Updated: 2026-03-26T18:35:47.179Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/45767 http://qdpm.net http://qdpm.net/download-qdpm-free-project-management https://www.vulncheck.com/advisories/qdpm-sql-injection-via-filter-by-parameters	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

qdPM 9.2

Notes

PURL mappings

Vulnerability references

Contribute