713 matches found
CVE-2026-69144
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...
CVE-2026-69144 SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...
EUVD-2026-117659
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...
CVE-2026-69144 SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...
CVE-2026-69144
In SuiteCRM versions prior to 7.15.2 and 8.10.2 , an authorization bypass exists in download.php due to Document Revision ID confusion . The application checks authorization against a Documents bean before determining if the provided identifier is a document_revisions.id. By submitting a revision...
CVE-2019-25779
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...
CVE-2019-25779
The WooThemes Diarise WordPress theme, in versions through 1.5.9 , is vulnerable to a file read vulnerability (Local File Disclosure). Unauthenticated attackers can exploit this by sending GET requests using the file:// scheme paths to the calendar parameter of the download.php file. This flaw al...
CVE-2019-25779 WooThemes Diarise 1.5.9 Local File Disclosure via download.php
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...
EUVD-2019-20210
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...
VulnCheck KEV: CVE-2019-25779
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...
CVE-2019-25779: Improper Limitation of a Pathname to a Restricted Directory
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...
PT-2026-121340
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...
CVE-2026-114257
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...
CVE-2026-114257 oretnom23 file-management-system-php File Download download.php readfile sql injection
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...
EUVD-2026-107336
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...
CVE-2026-114257 oretnom23 file-management-system-php File Download download.php readfile sql injection
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...
CVE-2026-114257 oretnom23 file-management-system-php File Download download.php readfile sql injection
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...
CVE-2026-114257
The oretnom23 file-management-system-php is vulnerable to SQL injection in the File Download component, specifically within the readfile function of the download.php file. The vulnerability is triggered by the manipulation of the ID argument and can be exploited remotely. While the exploit has be...
Woothemes Diarise path traversal vulnerability
Woothemes Diarise versions 1.5.9 and earlier contain a path traversal vulnerability. This flaw stems from the lack of validation on the calendar parameter in download.php, potentially allowing unauthenticated attackers to read arbitrary files via the file:// path, thereby exposing sensitive files...
PT-2026-120669
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...