WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download

Themewinter Eventin contains a path traversal caused by relative path manipulation, letting attackers access arbitrary files on the server, exploit requires no specific privileges or user interaction. id: CVE-2025-47445 info: name: WordPress Eventin Themewinter ≤ 4.0.26 - Arbitrary File Download...

Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data. id: CVE-2021-38146 info: name: Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Downloa...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

CVE-2025-30567

简介 WordPress WP01 未授权任意文件下载漏洞！ 环境搭建 步骤 1：下载 WP01 插件，但是... 哈哈，别担心，这里是该插件的源代码。 步骤 2：将提供的 wp01 文件夹打包并上传到 WordPress 插件区域。像这样-- 分析 很简单——漏洞在以下位置触发： 接下来，检查 makearchive 方法在何处被调用。 存在两个 AJAX 操作钩子——一个针对已登录用户，另一个针对未登录用户。这就是未授权访问漏洞的原因。 好了，现在让我们构造 payload 来读取本机上 /etc/passwd 的内容。 root@kitploit: POST...

CVE-2025-9215

StoreEngine 强大的 WordPress 电子商务插件（支付、会员、联盟营销、销售等）= 1.4.0 - 已认证（订阅者+）任意文件下载 StoreEngine 插件在其 CSV 导入/导出功能中包含一个漏洞，该漏洞允许任何已认证用户 （订阅者、作者、编辑等）从服务器下载任意文件，包括敏感的系统文件、WordPress 配置文件以及插件源代码。该漏洞源于 storeenginecsv/filedownload 端点缺乏适当的路径清理，仅依赖 nonce 验证来保证安全，而 storeenginenonce 通过插件的 JavaScript 暴露给所有前端用户...

day04-nexus-4956

Día 4 – Nexus Repository 3 Path Traversal CVE-2024-4956 Qué: El path traversal sin autenticación permite a cualquiera descargar archivos arbitrarios con una URL manipulada. Vuln: Afecta a versiones de Nexus Repo 3 ≤ 3.68.0. Corregido en 3.68.1. Fuente: Aviso de Sonatype + NVD. Seguridad: El...

CVE-2024-9935

CVE-2024-9935 PDF Generator 插件 for Elementor Page Builder = 1.7.5 - 未认证的任意文件下载 用法 python CVE-2024-9935.py http://example.com...

CVE-2017-18345-COM_JOOMANAGER-ARBITRARY-FILE-DOWNLOAD

COMJOOMANAGER 2.0 - DESCARGA ARBITRARIA DE ARCHIVOS Recolectando bases de datos en masa con el plugin: COMJOOMANAGER, del CMS: Joomla. Proyecto desarrollado en python 2.x. Para más información, accede al video de YouTube. CVE: 2017-18345 Riesgo : Alto riesgo de seguridad 0day.Today-ID: 29950...

CVE-2025-9345

Managefy 文件管理器、代码编辑器和备份中的路径遍历漏洞概念验证 漏洞类型： 路径遍历（任意文件下载） 受影响函数： ajaxdownloadfile 影响： 具有低权限（订阅者+）的已认证用户可以下载服务器上的任意文件，包括敏感配置文件，通过利用对 flmfile 参数验证不足。 CVSS v3.1 评分： 6.5（中危） 向量： AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 描述 GET 请求中的 flmfile 参数直接与备份目录路径拼接，未经充分清理。当前清理函数 FlmbkpFormHelper::sanitizeInputhtml 无法阻止 ....

CVE-2026-80494

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containin...

CVE-2026-80494 Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containin...

CVE-2026-80494

The Yogeta WP Cloud WordPress plugin (through version 1.0) contains an unauthenticated arbitrary file download vulnerability. A public endpoint fails to validate a user-supplied file path before passing it to a file-read function, and the endpoint requires no authorization. This allows any unauth...

CVE-2024-50508

CVE-2024-50508 Woocommerce Product Design = 1.0.0 - Descarga Arbitraria de Archivos No Autenticada Descripción El plugin Woocommerce Product Design para WordPress es vulnerable a Directory Traversal en todas las versiones hasta, e incluyendo, 1.0.0. Esto permite que atacantes no autenticados lean...

CVE-2024-9047

POC - Plugin WordPress File Upload, en el archivo wfufiledownloader.php antes de la versión = 4.24.11 - CVE-2024-9047 Descripción General El plugin WordPress File Upload es vulnerable debido a una validación de entrada incorrecta en el archivo wfufiledownloader.php, afectando a las versiones =...

RP_Import_RCE

Real Player 'external::Import': descarga arbitraria de archivos, vulnerabilidades de Directory Traversal que conducen a ejecución remota de código demo en video: https://youtu.be/CONlijEgDLc Real Player utiliza la funcionalidad de Microsoft Internet Explorer y expone propiedades y métodos a travé...

CVE-2026-81275

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275

The WordPress Youzify plugin (versions

EUVD-2026-75514

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2024-4956-Sonatype-Nexus-Repository-Manager

CVE-2024-4956-Sonatype-Nexus-Repository-Manager Sonatype Nexus Repository Manager proporciona una plataforma central para almacenar artefactos de compilación CVE-2024-4956 es una vulnerabilidad de path traversal en Sonatype Nexus Repository manager que permite a un atacante manipular una URL para...