CVE-2023-48246

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

PT-2024-1178 · Nexo-Os · Nexo-Os

Name of the Vulnerable Software and Affected Versions: NEXO-OS affected versions not specified Description: The issue allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. This is due to...

CVE-2023-51154

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php...

CVE-2023-51154

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php...

JIZHICMS Security Vulnerabilities

Extreme Networks Technology JIZHICMS Extreme CMS is an open source content management system CMS from China's Extreme Networks Technology. A security vulnerability exists in JIZHICMS v2.5, which originates from the component /admin/c/PluginsController.php containing an arbitrary file download...

PT-2024-14060 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: Jizhicms version 2.5 Description: The issue is related to an arbitrary file download vulnerability. It affects the component /admin/c/PluginsController.php. Recommendations: For Jizhicms version 2.5, consider restricting access to the...

CVE-2023-51154

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php...

CVE-2023-51154

CVE-2023-51154 affects Jizhicms v2.5 via /admin/c/PluginsController.php, enabling arbitrary file download. Reported CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, CRITICAL). Connected sources confirm the vulnerable component and high impact; exploitation details are not provided in the prima...

WordPress Ultimate Addons for Beaver Builder Plugin <= 1.35.13 is vulnerable to Arbitrary File Download

Software Ultimate Addons for Beaver Builder Type Plugin Vulnerable versions = 1.35.13 Fixed in 1.35.14 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-51401 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 8fb95010e714 Credits Rafi...

Arbitrary File Download Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-05347)

Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...

CVE-2023-25650

There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads...

CVE-2023-25650

There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads...

CVE-2023-25650 Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI

There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads...

CVE-2023-25650

CVE-2023-25650 affects ZTE ZXCLOUD iRAI, where the backend fails to escape special strings or restrict paths in the download interface, enabling an attacker with user permissions to modify a request parameter and trigger arbitrary file downloads. The vulnerability is rooted in improper input hand...

ZTE ZXCLOUD iRAI Security Vulnerability

ZTE ZXCLOUD iRAI is a virtualization device from ZTE Corporation ZTE, China. A security vulnerability exists in the ZTE ZXCLOUD iRAI that stems from an arbitrary file download vulnerability...

CVE-2023-5105 Frontend File Manager < 22.6 - Editor+ Arbitrary File Download

The Frontend File Manager Plugin WordPress plugin before 22.6 has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as wp-config.php...

Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion

Description The plugin does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server To download /etc/passwd: curl...

CVE-2023-46887

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability...

CVE-2023-46887

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability...

CVE-2023-46887

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability...