CVE-2019-25669CWE-89sql-injection

CVE-2019-25669

High · published April 6, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors and extract database information.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-06T01:16Z
Affected products (1)
ProductVersionsFixed in
qdpm/qdpm≤ 9.1—
References (4)
http://qdpm.net · [email protected]http://qdpm.net/download-qdpm-free-project-management · [email protected]https://www.exploit-db.com/exploits/46387 · [email protected]https://www.vulncheck.com/advisories/qdpm-sql-injection-via-search-by-extrafields-parameter · [email protected]
EPSS history
Timeline
  • 05 APR 20:45Z
    qdPM 9.1 SQL Injection via search_by_extrafields Parameter
    cvelistv5