Vendor
Qualitor versions 8.20 and earlier are vulnerable to unauthenticated remote code execution via PHP code injection into the gridValoresPopHidden parameter, with public proof-of-concept exploits available.