CVE-2020-19515

MEDIUMNuclei

qdPM 9.1 - Cross-site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-19515 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMqdPM 9.1 - Cross-site ScriptingCVSS 6.1

qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

To mitigate this vulnerability, it is recommended to apply the latest security patches or updates provided by the vendor.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscve2020cvexssqdpmunauthvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:qdpm:qdpm:9.1:*:*:*:*:*:*:*
Shodan: http.favicon.hash:762074255
FOFA: icon_hash=762074255
https://topsecalphalab.github.io/CVE/qdPM9.1-Installer-Cross-Site-Scripting http://qdpm.net/download-qdpm-free-project-management https://nvd.nist.gov/vuln/detail/CVE-2020-19515

Source: ProjectDiscovery

References

2