33877 matches found
CVE-2025-63686: Improper Access Control
There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 2020-11-23 in the document query function under the Download Center menu in the PersonManage system...
CVE-2025-58465: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions:...
CVE-2025-58463: Relative Path Traversal
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following...
PersonManage security vulnerabilities
PersonManage is a personnel management system by jinguomin personal developer. A security vulnerability exists in PersonManage, which stems from an arbitrary file download issue in the document lookup function...
QNAP Download Station security vulnerabilities
QNAP Download Station is a web-based download tool from Taiwan, China-based QNAP Technology QNAP. A security vulnerability exists in QNAP Download Station, which originates from relative path traversal and could result in reading unexpected files or system data...
QNAP Download Station Cross-Site Script Vulnerability
QNAP Download Station is a web-based download tool from Taiwan, China-based QNAP Technology QNAP. A cross-site scripting vulnerability exists in QNAP Download Station, which stems from susceptibility to cross-site scripting attacks that could result in bypassing security mechanisms or reading...
PT-2025-45437
Name of the Vulnerable Software and Affected Versions Download Station versions prior to 5.10.0.304 Description A cross-site scripting XSS issue exists in Download Station. A remote attacker who has obtained a user account can potentially exploit this issue to circumvent security measures or acce...
CVE-2025-63686
There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 2020-11-23 in the document query function under the Download Center menu in the PersonManage system...
PT-2025-45447
Name of the Vulnerable Software and Affected Versions GuoMinJim PersonManage versions prior to commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 2020-11-23 Description An arbitrary file download issue exists in the document query function within the Download Center menu of the PersonManage system...
CVE-2025-64178
Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be...
EUVD-2025-37862
Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be...
CVE-2025-64178
Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be...
CVE-2025-34238
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web...
CVE-2025-34238
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web...
CVE-2025-34238 Advantech WebAccess/VPN < 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web...
EUVD-2025-38105
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through = 1.4...
CVE-2025-60242
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through = 1.4...
CVE-2025-60242 WordPress Download Counter plugin <= 1.4 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through = 1.4...
CVE-2025-60242 WordPress Download Counter plugin <= 1.4 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through = 1.4...
