Description
In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file.
Remediation
References
Related Vulnerabilities
WordPress Plugin Essential Real Estate Cross-Site Scripting (1.7.1)
WordPress Plugin Adifier System Multiple Vulnerabilities (3.1.3)
WordPress Plugin Video Embed SQL Injection (1.0)
Chamilo Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-33704)
WordPress Plugin BetterDocs-Best Documentation & Knowledge Base Cross-Site Scripting (1.9.1)