| Package | Affected versions | Patched versions |
|---|---|---|
| qdpm | = 9.1 |
In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free