CVEvulnerability
CVE-2020-26166
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-10-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.
Affected configurations
• qdpm qdpm 9.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://qdpm.net/qdpm-release-notes-free-project-management Release Notes, Vendor Advisory
- https://github.com/Kajmer/CVEs/blob/main/CVE-2020-26166.md Third Party Advisory
- https://sourceforge.net/projects/qdpm/ Product, Third Party Advisory
- http://qdpm.net/qdpm-release-notes-free-project-management Release Notes, Vendor Advisory
- https://github.com/Kajmer/CVEs/blob/main/CVE-2020-26166.md Third Party Advisory
- https://sourceforge.net/projects/qdpm/ Product, Third Party Advisory