PT-2026-35437

A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and cou...

CVE-2020-37088 School ERP Pro 1.0 - Arbitrary File Read

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system...

Arox School ERP Pro 路径遍历漏洞

Arox School ERP Pro is a one-stop automation management platform offered by Arox Corporation. Version 1.0 of Arox School ERP Pro contains a path traversal vulnerability. This vulnerability stems from a file leakage issue in the document parameter within the download.php file. Attackers can access...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2024-36800

A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php...

CVE-2022-29720

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

Schoolhos CMS 'download.php' SQL Injection Vulnerability

Schoolhos CMS is a free and open source content management system. A SQL injection vulnerability exists in download.php in Schoolhos CMS version 2.29, which can be exploited by an attacker to compromise the application, access or modify data, or exploit a potential vulnerability in the underlying...

NITC 3.21 /download.php 任意文件下载漏洞

No description provided by source...

CVE-2008-3589

Directory traversal vulnerability in download.php in moziloCMS 1.10.1, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the cat parameter...

ezwebalbum-disclose.txt

EZWebAlbum dlfilename Remote File Disclosure Vulnerability |, .-. .-. ,| Found by : Ghost Hacker R-H TeaM | o/ \o | My Site web : Real-hack.Net |/ /\ | Found by : Ghost Hacker R-H TeaM Home page : www.Real-hack.net Email : [email protected] Name Script : EZWebAlbum Download Script :...