WordPress Plugin Download Manager 2.7.2 - Privilege Escalation

WordPress Plugin Download Manager 2.7.2 - Privilege Escalation Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation Date: 24-11-2014 Software Link: https://wordpress.org/plugins/download-manager/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

WordPress Plugin Download Manager 2.7.2 - Privilege Escalation

Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation Date: 24-11-2014 Software Link: https://wordpress.org/plugins/download-manager/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps CVE: CVE-2014-9260 1...

WordPress Download Manager Plugin 2.7.2 - Privilege Escalation

Download Manager plugin is prone tu vulnerability that allows an attacker to take control of every group change name, description, avatar and settings. In this case, every registered user can update every WordPress options using basicsettings function. Solution Update to version 2.7.3...

WordPress CM Download Manager Plugin 2.0.0 - Code Injection

Code injection vulnerability was found in the software and confirmed as an anonymous user. It allows an attacker to gain full control of the application and use all operating system functions. Solution Update to version 2.0.4...

WordPress Plugin CM Download Manager 2.0.0 - Code Injection

WordPress Plugin CM Download Manager 2.0.0 - Code Injection Vulnerability title: Code Injection in Wordpress CM Download Manager plugin 2.0.0 CVE: CVE-2014-8877 Plugin: CM Download Manager plugin Vendor: CreativeMinds - https://www.cminds.com/ Link download:...

WordPress Plugin CM Download Manager 2.0.0 - Code Injection

Vulnerability title: Code Injection in Wordpress CM Download Manager plugin 2.0.0 CVE: CVE-2014-8877 Plugin: CM Download Manager plugin Vendor: CreativeMinds - https://www.cminds.com/ Link download: https://wordpress.org/plugins/cm-download-manager/ Affected version: 2.0.0 and previous version...

WordPress CM Download Manager Plugin Remote PHP Code Execution Vulnerability

The CM Download Manager for WordPress is prone to remote PHP-code execution vulnerability SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress CM Download Manager 2.0.0 Code Injection Vulnerability

WordPress CM Download Manager plugin versions 2.0.0 and below suffer from a code injection vulnerability. Vulnerability title: Code Injection in Wordpress CM Download Manager plugin CVE: CVE-2014-8877 Plugin: CM Download Manager plugin Vendor: CreativeMinds - https://www.cminds.com/ Product:...

CM Download Manager <= 2.0.0 - Unauthenticated Code Injection

The plugin does not validate and sanitise the CMDsearch parameter which used to create a custom function. This allows attacker to run arbitrary command on the remote server GET /cmdownloads/?CMDsearch=".phpinfo." HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:33.0...

WordPress CM Download Manager 2.0.0 Code Injection

Vulnerability title: Code Injection in Wordpress CM Download Manager plugin CVE: CVE-2014-8877 Plugin: CM Download Manager plugin Vendor: CreativeMinds - https://www.cminds.com/ Product: https://wordpress.org/plugins/cm-download-manager/ Affected version: 2.0.0 and previous version Fixed version:...

Wordpress Download Manager Plugin Arbitrary File Upload (CVE-2008-3362)

An Arbitrary File Upload vulnerability has been reported in Wordpress Download Manager Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2014-8585

Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the fname parameter to 1 views/filedownload.php or 2 filedownload.php...

Directory traversal

Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the fname parameter to 1 views/filedownload.php or 2 filedownload.php...

CVE-2014-8585

Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the fname parameter to 1 views/filedownload.php or 2 filedownload.php...

CVE-2014-8585

CVE-2014-8585 affects the WordPress Download Manager plugin. A directory traversal flaw in fname (via views/file_download.php or file_download.php) allows remote attackers to read arbitrary files. Root cause is improper validation of the fname parameter, enabling access to unintended filesystem p...

WordPress Download Manager Plugin - Arbitrary File Download

Because of this vulnerability, the attackers can read arbitrary files in the "fname" parameter to views/filedownload.php or filedownload.php. Solution Update the plugin...

WordPress Download Manager Arbitrary File Download

WordPress Download Manager Plugin - Arbitrary File Download CWE: CWE-98 Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 25/10/2014 Vendor Homepage: https://wordpress.org/plugins/download-manager/ Tested on: Windows 7 and Gnu/Linux Google Dork:...

WP-DownloadManager 1.60 - Script Insertion CSRF

The wp-download-manager WordPress plugin was affected by a Script Insertion CSRF security vulnerability...

WP-Filebase Download Manager 0.3.0.02 - class/Admin.php GetFileHash Function Remote Comm& Execution

The wp-filebase WordPress plugin was affected by a class/Admin.php GetFileHash Function Remote Comm& Execution security vulnerability...

Download Manager <= 2.5.8 - Download Package file Parameter Stored XSS

The WordPress Download Manager WordPress plugin was affected by a Download Package file Parameter Stored XSS security vulnerability...