CVE-2020-26166 - The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS

Back Back to CVE browser

MEDIUM

The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS

Published Oct 5, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 0.85%

Description

The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

http://qdpm.net/qdpm-release-notes-free-project-management
x_refsource_MISCRelease NotesVendor Advisory
https://github.com/Kajmer/CVEs/blob/main/CVE-2020-26166.md
x_refsource_MISCThird Party Advisory
https://sourceforge.net/projects/qdpm/
x_refsource_MISCProductThird Party Advisory

Link	Providers	Tags
http://qdpm.net/qdpm-release-notes-free-project-management		x_refsource_MISCRelease NotesVendor Advisory
https://github.com/Kajmer/CVEs/blob/main/CVE-2020-26166.md		x_refsource_MISCThird Party Advisory
https://sourceforge.net/projects/qdpm/		x_refsource_MISCProductThird Party Advisory