CVE-2020-25729: Improper Neutralization of Input During Web Page Generation

ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...

MPC Sharj 3.11.1 - Arbitrary File Download

Exploit title : MPC Sharj 3.11.1 - Arbitrary File Download Exploit Author : SajjadBnd Date : 2020-05-02 Software Link : http://dl.nuller.ir/mpc-sharj-vr3.11.1betawww.nuller.ir.zip Tested on : Ubuntu 19.10 Version : 3.11.1 Beta DESCRIPTION MPC Sharj is a free open source script for creating sim ca...

School ERP Pro 1.0 Arbitrary File Read

Exploit Title: School ERP Pro 1.0 - Arbitrary File Read Date: 2020-04-28 Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail BOZKURT CVE: N/A Vulnerable code:...

UADMIN Botnet SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: UADMIN Botnet - SQL Injection Vulnerability Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: unkn0wn Version: unkn0wn Tested on: Windows 10, Kali CVE : n/a Vuln-Code: download.php $link=$GET'link';...

UADMIN Botnet 1.0 - 'link' SQL Injection

Exploit Title: UADMIN Botnet 1.0 - 'link' SQL Injection Google Dork: n/a Date: 2020-03-16 Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: unkn0wn Version: unkn0wn Tested on: Windows 10, Kali CVE : n/a Vuln-Code: download.php $link=$GET'link'; $agent=esc$SERVER'HTTPUSERAGENT';...

CVE-2020-10387

CVE-2020-10387 describes a path traversal vulnerability in Chadha PHPKB Standard Multi-Language 9, exposed via the admin/download.php endpoint. The flaw allows traversal of the server file system through the GET parameter “file” (using dot-dot-slash sequences), enabling arbitrary file download. P...

CVE-2020-10387: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence ../ via the GET parameter file...

CVE-2019-16986

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

CVE-2019-16986: Improper Limitation of a Pathname to a Restricted Directory

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

Directory traversal

The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter...

CVE-2015-9473

The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter...

CVE-2015-9470

The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter...

CVE-2015-9473: Improper Limitation of a Pathname to a Restricted Directory

The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter...

PT-2019-7429

Name of the Vulnerable Software and Affected Versions history-collection plugin versions through 1.1.1 for WordPress Description The issue concerns directory traversal via the var parameter in the download.php endpoint. This allows unauthorized access to sensitive files and directories...

PT-2019-7432

Name of the Vulnerable Software and Affected Versions estrutura-basica theme versions through 2015-09-13 Description The issue concerns directory traversal in the estrutura-basica theme for WordPress. This is achieved via the arquivo parameter in the "scripts/download.php" endpoint. Recommendatio...

CVE-2015-9470: Improper Limitation of a Pathname to a Restricted Directory

The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter...

CVE-2019-16894

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

Sql injection

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

CVE-2019-16894

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

CVE-2019-16894

CVE-2019-16894 concerns inoERP 4.15, where download.php is vulnerable to SQL injection via insecure deserialization. The root cause is insecure handling of serialized data in the download path, enabling an attacker to manipulate SQL queries and potentially extract or alter data. The vulnerability...