https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T11:58:26.182695+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2018-25208 CVE-2018-25208 — qdPM 9.1 SQL Injection via filter_by Parameters 2026-10-12T11:58:26.183830+00:00

Affected: qdPM

qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data.