PT-2023-23431 · Fuxa · Fuxa

Name of the Vulnerable Software and Affected Versions: FUXA versions 1.1.12 and earlier Description: The issue allows for Local File Inclusion via the "/api/download" API endpoint. This could potentially be exploited to access sensitive files on the system. Recommendations: For versions 1.1.12 an...

PT-2023-27177 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions 1.4.3 Description: 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface, specifically the "POST...

PT-2023-22702 · Ebankit · Ebankit

Name of the Vulnerable Software and Affected Versions: ebankIT versions prior to 7 Description: An issue allows a Denial-of-Service attack through the EStatementsIds GET parameter located on the "/Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx" endpoint. This parameter accepts...

CVE-2023-27755

go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...

PT-2023-20865 · Unknown · Onekeyadmin

Name of the Vulnerable Software and Affected Versions: onekeyadmin version 1.3.9 Description: The issue is related to an arbitrary file read vulnerability. This vulnerability can be exploited via the /admin1/file/download API endpoint. Recommendations: For onekeyadmin version 1.3.9, consider...

ZZCMS SQL注入漏洞

ZZCMS is a content management system CMS from the ZZCMS team in China. zzCMS version 2019 is vulnerable to SQL injection, which stems from the lack of security filtering of the id parameter in /dl/dldownload.php. No detailed vulnerability details are provided at this time...

CVE-2021-26034

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in data download endpoints in combanners and comsysinfo...

PT-2019-18537 · Zoneminder +3 · Zoneminder +3

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.32.4 Description: A Reflected Cross Site Scripting issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable eid parameter value in the "download.php" API endpoint, due to omitted...

CVE-2017-7282

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access...

PT-2007-1411 · Php · Upload Tool For Php

Name of the Vulnerable Software and Affected Versions: Upload Tool for PHP version 1.0 Description: The issue allows remote attackers to read arbitrary files via directory traversal attacks using ".." sequences or absolute pathnames in the filename parameter of the /upload/bin/download.php API...