CVE-2026-66750-Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-

Security Advisory: Insufficient Access Controls Allow for Unauthorized File Downloads Let's Chat Assigned CVE ID: CVE-2026-66750 Summary GET /files/:id/:name checks that the caller is logged in and then serves the file. It never checks whether the caller is allowed to see the room the file belong...

EUVD-2026-90884

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

CVE-2026-94620 Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

CVE-2026-94620 Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

CVE-2026-94620

Prior to version 1.11.0 , the Classroom 50 tool is vulnerable to an arbitrary file write when using the gh teacher download command. The root cause is that the tool follows symlinks when writing autograde artifacts (result.json and results.json) into a student's cloned repository. An attacker can...

selenium-node-takeover-kit

Metasploit Exploits This project has moved. To get the latest version, pull from https://codeberg.org/JonStratton/selenium-node-takeover-kit This combines some of the examples below to upload files to, download files from, and execute code on a Selenium node via the “COMMANDTYPE” param. RCE...

AOSP-DownloadProviderHeadersDumper

AOSP-DownloadProviderHeadersDumper PoC Exploiting Headers Disclosure in Android's Download Provider CVE-2018-9546 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-Request-Headers-Disclosure-CVE-2018-9546.pdf More Information...

CVE-2024-50623

CVE-2024-50623 Cleo Unrestricted file upload and download PoC CVE-2024-50623 Arbitrary File Write python CVE-2024-50623.py --target http://192.168.1.18:5080/Synchronization --action write --what poc.dll --where "........\poc.dll" / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y...

CVE-2018-13379

CVE-2018-13379 - FortiGate SSL-VPN Path Traversal PoC Description Proof-of-Concept script for CVE-2018-13379, a critical path traversal vulnerability in Fortinet FortiGate SSL VPN web portal. This vulnerability allows unauthenticated attackers to download system files via specially crafted HTTP...

CVE-2026-86610

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

EUVD-2026-90511

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

WordPress Download Manager plugin < 3.3.71 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Mark Moore in WordPress Plugin Download Manager versions 3.3.71...

CVE-2026-86610

The Download Manager WordPress plugin (versions before 3.3.71 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient sanitization and escaping of a package setting before it is rendered on a page; specifically, the sanitization logic fails to neutralize single quote...

VulnCheck KEV: CVE-2025-11913

A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. The attack can be launched remotely. The exploit h...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2023_0855)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230855 advisory. sinatra: Reflected File Download attack CVE-2022-45442 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

Rocky Linux 9 [CIQ] Security Update: python3.12-setuptools / python3.12-setuptools-wheel (crlsa-2024_5533)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20245533 advisory. pypa/setuptools: Remote code execution via download functions in the packageindex module in pypa/setuptools CVE-2024-6345 Tenable has extracted the preceding...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_1802)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231802 advisory. Thunderbird: Revocation status of S/Mime recipient certificates was not checked CVE-2023-0547 Mozilla: Matrix SDK bundled with Thunderbird vulnerable to...

Rocky Linux 10.0 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_10195)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510195 advisory. thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links CVE-2025-5986 Tenable has extracted the...