rmdown.com XSS vulnerability

Open Bug Bounty ID: OBB-94419 Description| Value ---|--- Affected Website:| rmdown.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

GDL 4.2 download.php&main.php SQL Injection vulnerability

No description provided by source...

WordPress DB-Backup Plugin 4.5 /download.php 任意文件下载漏洞

No description provided by source...

Path traversal

Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter...

CVE-2015-5472

CVE-2015-5472 affects the WordPress IBS Mappro plugin (prior to version 1.0). A flaw in lib/download.php allows an attacker to perform absolute path traversal by supplying a full pathname in the file parameter, enabling reading of arbitrary files on the server. The vulnerability is confirmed acro...

MP3-jPlayer <= 2.4.2 - Full Path Disclosure

The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...

WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download

Title: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-02 Download Site: https://wordpress.org/plugins/wp-swimteam Vendor: Mike Walsh www.MichaelWalsh.org Vendor Notified: 2015-07-02, fixed in v1.45beta3 Vendor...

WordPress IBS Mappro Plugin <= 0.9 - Absolute Path Traversal

This vulnerability is in lib/download.php. It allows an attacker to read arbitrary files via a full pathname in the "file" parameter. Solution Update the plugin...

Swim Team <= v1.44.10777 - Local File Inclusion

The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files. PoC $ curl "http://www.vapidlabs.com/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd=/etc/passwd=text/html=1=/usr/share/wordpress"...

MDC YouTube Downloader <= 2.1.0 - Local File Inclusion

The MDC YouTube Downloader WordPress plugin was affected by a Local File Inclusion security vulnerability. http://www.example.com/wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd...

WordPress Estrutura-Basica theme 'download.php' arbitrary file download vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Estrutura-Basica is one of the basic structure themes. An arbitrary file download vulnerability exists in the WordPres...

WordPress Estrutura-Basica File Disclosure

: Exploit Title : Wordpress estrutura-basica Themes Local File Download Vulnerability : Exploit Author : FullSecurity.org : Vendor Homepage : http://wordpress.org : Date: 2015-13-09 : Tested On : Kali linux : Exploit :...

MediaSuite.ca File Disclosure

. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://twitter.com/h4SEC / \ | \ \ Proof Video: https://www.youtube.com/watch?v=7yxbfD1YK8Y / // / \ / My + Author : KnocKout E-Mail : [email protected] Twitter: http://twitter.com/h4SEC HomePage :...

WordPress Plugin DB_Backup 4.5 /download.php 任意文件下载漏洞

No description provided by source...

CVE-2014-100031

Multiple SQL injection vulnerabilities in Ganesha Digital Library GDL 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in 1 download.php or 2 main.php...

Sql injection

Multiple SQL injection vulnerabilities in Ganesha Digital Library GDL 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in 1 download.php or 2 main.php...

WordPress Antioch Arbitrary File Download Vulnerability

WordPress Antioch theme suffers from an arbitrary file download vulnerability. Note that this finding houses site-specific data. |||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | Exploit Title: Wordpress Antioch Theme...

WordPress Theme Antioch - 'download.php' Arbitrary File Download

source: https://www.securityfocus.com/bid/69673/info Antioch theme for Wordpress is prone to an arbitrary file-download vulnerability. An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information...

CVE-2014-5465

Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

Directory traversal

Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...