CVE-2020-21934

An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the Syslog could be bypassed...

CVE-2020-13894

handler/uploadhandler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field...

CVE-2020-16136

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...

CVE-2020-35577

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference IDOR allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier aka CommonDownload identification number...

CVE-2019-19616

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

CVE-2019-17087

Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under...

CVE-2025-2306

An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents without authentication, if the URL is known. The attack requires the attacker to know the documents UUIDv4...

CVE-2024-9765

The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory...

SYNCPILOT LIVE CONTRACT 输入验证错误漏洞

SYNCPILOT LIVE CONTRACT is a real-time contract program from SYNCPILOT Germany. A security vulnerability exists in SYNCPILOT LIVE CONTRACT that stems from a path traversal vulnerability in the file download function, which could result in an unauthenticated user downloading an arbitrary file...

CVE-2024-8031

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...

CVE-2024-9765 EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability

The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory...

Arbitrary File Download Vulnerability in Cloud Desktop of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is an industry-leading leader in digital solutions. An arbitrary file download vulnerability exists in the cloud desktop of Xinhua San Technologies Limited, which can be exploited by attackers to download arbitrary files and obtain sensitive information...

WordPress Print Science Designer plugin <= 1.3.155 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Print Science Designer versions = 1.3.155...

CVE-2025-30882

The CVE-2025-30882 entry concerns JS Help Desk for WordPress with an Unauthenticated Path Traversal that allows Arbitrary File Download in versions up to 2.9.1. The vulnerability has a high potential impact (CVSS v3.1: 7.5, Attack Vector Network, Privileges None, User Interaction None) with Confi...

Mars: ███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration

A publicly accessible directory containing sensitive WordPress configuration files, including database credentials, authentication keys, and API secrets, was discovered. The vulnerability allowed unauthorized access to critical system information through a downloadable zip file. The security team...

CVE-2024-54291 WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in NotFound PluginPass allows Manipulating Web Input to File System Calls. This issue affects PluginPass: from n/a through 0.9.10...

CVE-2024-13617

CVE-2024-13617 concerns the aoa-downloadable WordPress plugin (

CVE-2024-13617 Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download

The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server...

PT-2025-12756 · WordPress · Aoa-Downloadable

Name of the Vulnerable Software and Affected Versions: aoa-downloadable WordPress plugin version 0.1.0 Description: The issue concerns the aoa-downloadable WordPress plugin, which fails to validate a parameter in its download function. This allows unauthenticated attackers to download arbitrary...

CVE-2024-8501

Summary : CVE-2024-8501 affects the modelscope/agentscope project, specifically the rpc_agent_client component in version v0.0.4. The vulnerability permits an attacker to leverage the download_file method to download arbitrary files from the rpc_agent host. Impact : This can lead to unauthorized ...