WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure

The WordPress Download Manager plugin before version 3.3.07 does not prevent directory listing on web servers that don't use htaccess, allowing unauthorized access to files stored in the download-manager-files directory. id: CVE-2024-13126 info: name: WordPress Download Manager 3.3.07 -...

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

WordPress Download Manager <2.9.94 - Cross-Site Scripting

WordPress Download Manager plugin before 2.9.94 contains a cross-site scripting vulnerability via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter. id: CVE-2019-15889 info: name: WordPress Download Manager 2.9.94 - Cross-Site Scripting author: daffainf...

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting

The WordPress Download Manager plugin before version 3.2.44 does not properly sanitize and escape the userids parameter in the stats history dashboard. This allows authenticated attackers to perform Cross-Site Scripting attacks by injecting malicious JavaScript code. id: CVE-2022-2168 info: name:...

CVE-2026-121451

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

CVE-2026-121451

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

CVE-2026-121451

AB Download Manager versions prior to 1.11.2 are vulnerable to a cross-site request forgery (CSRF) vulnerability within its unauthenticated browser-integration API. An attacker can exploit this by tricking a user into visiting a malicious webpage that sends a text/plain request to the /start-head...

EUVD-2026-115883

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

CVE-2026-121451: amir1376 ab-download-manager: AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated…

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

root-my-webos-tv

Root my webOS TV A simple python script that starts a telnet server on vulnerable webOS devices as root. Verified TVs webOS 4.9.7 - 5.30.40 model LG43UM7000PLA webOS 5.5.0 - 04.50.51 model OLED55CXPUA webOS 6.3.3-442 kisscurl-kinglake - 03.36.50 model OLED48C1PUB webOS 7.3.1-43 mullet-mebin -...

Cve-2026-39676

Cve-2026-39676 Wordpress Version: Download Manager 3.3.5.2 Title: Missing Authorization - Unauthenticated IDOR Exploit...

CVE-2023-6421

CVE-2023-6421 Download Manager 3.2.83 - Unauthenticated Protected File Download Password Leak Description The plugin does not protect file download's passwords, leaking it upon receiving an invalid one POC python3 CVE-2023-6421.py https://kubernetes.docker.internal No link generated for ID 1. No...

webos-downloadmanager-root

webos-downloadmanager-root Candidate root chain on LG webOS T...

CVE-2026-86611

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...

CVE-2026-86611 Download Manager (Free & Pro) - Privacy Settings Update via CSRF

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...

WordPress Download Manager plugin 4.0.0-7.5.8 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 4.0.0-7.5.8...

EUVD-2026-107085

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...

CVE-2026-86611

The Download Manager WordPress plugin (Free & Pro) versions before 3.3.71 and before 7.5.9 are vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is a lack of CSRF checks in specific locations, which allows an attacker to trick a logged-in administrator into updating the plugin's ...

WordPress Download Manager plugin < 3.3.71 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 3.3.71...