CVE-2015-5469

Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php...

WordPress Plugin Mac Photo Gallery 3.0 - Arbitrary File Download

WordPress Plugin Mac Photo Gallery 3.0 - Arbitrary File Download Exploit Title: WordPress Plugin Mac Photo Gallery v3.0 - Arbitrary File Download Google Dork: N/A Date: 09.03.2017 Vendor Homepage: https://www.apptha.com/ Software:...

PHP PEAR 1.10.1 - arbitrary File Download Vulnerability (CVE-2017-5630)

Author: mapl0 Vulnerability details In the PEAR Base System The 1. 10. 1 version of the installer, can be in after the redirect does not verify file type and file name, and then allows the remote http server via a specially crafted request to overwrite the hacked server files, such as. htaccess i...

FineCMS controllers\ApiController.php function downAction arbitrary File Download

Vulnerability file in D:\wamp\www\controllers\ApiController. in php downAction function / Download the file / public function downAction $data = fnauthcodebase64decode$this-get'file', 'DECODE'; $file = isset$data'finecms' && $data'finecms' ? $data'finecms' : "; if empty$file...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

File Download Vulnerability in TORS WAS

TRS WAS is a functional presentation platform. A file download vulnerability exists in TORS WAS. Allowing an attacker can download files and obtain sensitive system information...

Arbitrary File Download Vulnerability in ShowDownload Function of Tibco Call Center System

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. An arbitrary file download vulnerability exists in the showDownload function of the Tibco Call Center System. The vulnerability file is: /userweb/php/index/log.class.php, whic...

Wordpress candidate-application-form plugin file download vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. candidate-application-form is one of the plugins used to add a candidate application form to a job opening. A file download vulnerability exists in version v1.0 of the Wordpress...

Joomla! com_cckjseblod configuration file download vulnerability

Joomla! is an open source content management system CMS. A file download vulnerability exists in the Joomla! comcckjseblod configuration. An attacker can exploit this vulnerability to obtain sensitive system information...

While trying Server 6.0 mail system has an arbitrary File Download vulnerability

No description provided by source...

ZXECS EBG2800 enterprise business gateway system download.php the file id parameter arbitrary File Download vulnerability

No description provided by source...

Strong intelligent academic management system /public/download. asp file the filename parameter arbitrary File Download vulnerability

No description provided by source...

File Containment Vulnerability in Online Marking System of Nanhao (Beijing) Technology Co.

Nanhao Online Marking System is an examination system for daily examination. Nanhao Online Marking System has multiple arbitrary file download vulnerabilities, which can be exploited by attackers to download database script files...

Shanghai Zhuo fan cms government service center/index/downLoadFile. action download vulnerability

http://xxx.com/index/downLoadFile.action?fileName=web.xml&filePath=WEB-INF/web.xml...

天融信TopApp-AD /acc/vpn/download.php 下载漏洞

No description provided by source...

CVE-2016-3168

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...

CVE-2016-3168

The CVE-2016-3168 issue affects Drupal: System module in Drupal 6.x prior to 6.38 and 7.x prior to 7.43 is vulnerable to a reflected file download that can allow remote attackers to hijack the authentication of site administrators when downloading and executing files containing arbitrary JSON-enc...

Mageia: Security Advisory (MGASA-2016-0118)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

kingdee协同办公系统 fileDownload.do 任意文件下载漏洞

No description provided by source...

ProjectSend has multiple vulnerabilities

ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. ProjectSend contains authentication bypass vulnerabilities, SQL injection vulnerabilities, and arbitrary file download vulnerabilities, which can be exploited by an attacker to execute arbitrary code...