59 matches found
WordPress Download Plugin plugin <= 1.6.2 - Auth. Broken Access Control vulnerability
Auth. Broken Access Control vulnerability discovered by apple502j in WordPress Download Plugin plugin versions = 1.6.2. Solution Update the WordPress Download Plugin plugin to the latest available version at least 2.0.0...
CVE-2021-24703
The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwappluginactivate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed...
CVE-2021-24703
The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwappluginactivate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed...
CVE-2021-24703
Summary: CVE-2021-24703 affects the WordPress Download Plugin (pre-1.6.1). The issue is in the dpwap_plugin_activate AJAX action, which lacks capability checks and CSRF verification. As a result, any authenticated user (e.g., subscribers) can activate plugins that are already installed. Impact (a...
CVE-2021-24703 Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwappluginactivate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed...
PT-2021-16207 · WordPress · Download Plugin
Name of the Vulnerable Software and Affected Versions: Download Plugin WordPress plugin versions prior to 1.6.1 Description: The issue concerns a lack of capability and CSRF checks in the dpwap plugin activate AJAX action. This allows any authenticated users to activate plugins that are already...
WordPress plugin Download Plugin 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
WordPress Download Plugin plugin <= 1.6.0 - Arbitrary Plugin Activation vulnerability
Arbitrary Plugin Activation vulnerability discovered by apple502j in WordPress Download Plugin plugin versions = 1.6.0. Solution Update the WordPress Download Plugin plugin to the latest available version at least 1.6.1...
Easy Media Download < 1.1.7 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape the text argument of its shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. PoC Affected argument: url, text, target, rel and class easymediadownload url="/" text='" onerror="alert/XSS///http'...
CVE-2016-10924
The ebook-download plugin before 1.2 for WordPress has directory traversal...
CVE-2016-10924
The ebook-download plugin before 1.2 for WordPress has directory traversal...
CVE-2016-10924
The ebook-download plugin before 1.2 for WordPress has directory traversal...
CVE-2015-7517
Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to 1 class-doifd-download.php or 2 class-doifd-landing-page.php in public/includes/...
CVE-2015-7517
CVE-2015-7517 affects the WordPress plugin Double Opt-In for Download (public/includes/ files) with SQL injection via the ver parameter in class-doifd-download.php and class-doifd-landing-page.php. Affected versions are prior to 2.0.9. Root cause is improper handling of user-supplied ver data ena...
WordPress Download Plugin <= 1.0.1 - Arbitrary Directory Download Vulnerability
Arbitrary Directory Download Vulnerability was found in WordPress Download Plugin in 1.0.1 version. There's no restriction against directory download in the dpwapdownload function. It's a very serious vulnerability because an attacker can download the whole site directory. Update the plugin as so...
WordPress plugin W3 Total Cache critical Vulnerability disclosed
One of the most popular Wordpress Plugin called "W3 Total Cache" which is used to Improve site performance and user experience via caching, having potential vulnerability. On Christmas day, someone disclose it on full-disclosure site that how a plugin misconfiguration leads to possible Wordpress...
CVE-2008-1646
SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dlid parameter...
WordPress WP Download Plugin <= 1.2 - SQL Injecion
Because of this vulnerability in wp-download.php, the attackers can execute arbitrary SQL commands via the "dlid" parameter. Solution Update the plugin...
PR07-13: Cross-site Scripting / HTML injection on F5 FirePass 4100 SSL VPN 'download_plugin.php3' server-side script
Date Found: 19th June 2007 Successfully tested on: version 5.5.2 F5 Networks has confirmed the following versions to be vulnerable: FirePass versions 5.4 - 5.5.2 FirePass versions 6.0 - 6.0.1 Description: F5 Networks FirePass 4100 SSL VPN is vulnerable to XSS within the "backurl" parameter...