high8.8
CVE-2020-26165
qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unseri…
Impact
qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qdpm | Qdpm | through 9.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/160733/qdPM-9.1-PHP-Object-Injection.html
- http://qdpm.net/qdpm-release-notes-free-project-management
- http://seclists.org/fulldisclosure/2021/Jan/10
- http://packetstormsecurity.com/files/160733/qdPM-9.1-PHP-Object-Injection.html
- http://qdpm.net/qdpm-release-notes-free-project-management
- http://seclists.org/fulldisclosure/2021/Jan/10