Description
qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class.php because unserialize is used.
Remediation
References
Related Vulnerabilities
WordPress Plugin Coming Soon Page & Maintenance Mode Cross-Site Request Forgery (1.7.8)
WordPress Plugin WordPress Calls to Action Cross-Site Scripting (2.2.7)
WordPress Plugin Current Book Cross-Site Scripting (1.0.1)
WordPress Plugin WP Fastest Cache Arbitrary File Deletion (0.8.9.0)
Oracle Application Server CVE-2009-0996 Vulnerability (CVE-2009-0996)