CVE-2015-3884

Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.

• CWE-434

• http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• http://rossmarks.uk/portfolio.phpThird Party Advisory
• http://rossmarks.uk/whitepapers/qdPM_8.3.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• http://rossmarks.uk/portfolio.phpThird Party Advisory
• http://rossmarks.uk/whitepapers/qdPM_8.3.txtExploit, Third Party Advisory

Published

Mar 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3878Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 …
• CVE-2015-3879Media Player Framework in Android before 5.1.1 LMY48T allows…
• CVE-2015-3880Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x…
• CVE-2015-3881Information disclosure issue in qdPM 8.3 allows remote attac…
• CVE-2015-3882qdPM 8.3 allows remote attackers to obtain sensitive informa…
• CVE-2015-3883Multiple cross-site scripting (XSS) vulnerabilities in qdPM …
• CVE-2015-3885Integer overflow in the ljpeg_start function in dcraw 7.00 a…
• CVE-2015-3886libinfinity before 0.6.6-1 does not validate expired SSL cer…
• CVE-2015-3887Untrusted search path vulnerability in ProxyChains-NG before…
• CVE-2015-3888Jolla Sailfish OS before 1.1.2.16 allows remote attackers to…
• CVE-2015-3890Use-after-free vulnerability in Open Litespeed before 1.3.10…7.5
• CVE-2015-3897Directory traversal vulnerability in Bonita BPM Portal befor…