CVE-2020-7246

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

• CWE-22
• CWE-434

• http://packetstormsecurity.com/files/156063/qdPM-9.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/156571/qdPM-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/167264/qdPM-9.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://docs.google.com/document/d/13ZZSm0DL1Ie6r_fU5ZdDKGZ4defFqiFXMG--zDo8S10/edit?usp=sharingExploit, Third Party Advisory
• http://packetstormsecurity.com/files/156063/qdPM-9.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/156571/qdPM-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/167264/qdPM-9.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/168559/qdPM-9.1-Authenticated-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://docs.google.com/document/d/13ZZSm0DL1Ie6r_fU5ZdDKGZ4defFqiFXMG--zDo8S10/edit?usp=sharingExploit, Third Party Advisory

Published

Jan 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7240Meinberg Lantime M300 and M1000 devices allow attackers (wit…8.8
• CVE-2020-7241The WP Database Backup plugin through 5.5 for WordPress stor…7.5
• CVE-2020-7242Comtech Stampede FX-1010 7.4.3 devices allow remote authenti…7.2
• CVE-2020-7243Comtech Stampede FX-1010 7.4.3 devices allow remote authenti…7.2
• CVE-2020-7244Comtech Stampede FX-1010 7.4.3 devices allow remote authenti…7.2
• CVE-2020-7245Incorrect username validation in the registration process of…9.8
• CVE-2020-7247smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in…9.8
• CVE-2020-7248libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 ha…7.5
• CVE-2020-7249SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID f…4.8
• CVE-2020-7250Symbolic link manipulation vulnerability in McAfee Endpoint …7.8
• CVE-2020-7251Improper access control vulnerability in Configuration Tool …5.5
• CVE-2020-7252Unquoted service executable path in DXL Broker in McAfee Dat…5.5