CVE-2019-16894: Improper Neutralization of Special Elements used in an SQL Command

download.php in inoERP 4.15 allows SQL injection through insecure deserialization...

PT-2019-14850

Name of the Vulnerable Software and Affected Versions inoERP version 4.15 Description The issue is related to SQL injection through insecure deserialization in the download.php file. Recommendations For inoERP version 4.15, update to a version that includes a fix for this issue, if available. As ...

CVE-2014-10397

The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php...

CVE-2014-10397: Improper Limitation of a Pathname to a Restricted Directory

The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php...

PT-2019-7072

Name of the Vulnerable Software and Affected Versions Epic theme for WordPress versions through 2014-09-07 Description The issue allows arbitrary file downloads via the file parameter to the "includes/download.php" endpoint. This could potentially lead to unauthorized access to sensitive files...

PT-2019-7073

Name of the Vulnerable Software and Affected Versions Antioch theme for WordPress versions through 2014-09-07 Description The issue allows arbitrary file downloads via the file parameter to "lib/scripts/download.php". This enables unauthorized access to files on the system. Recommendations For...

CVE-2014-10396: Improper Limitation of a Pathname to a Restricted Directory

The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php...

PT-2019-13738

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.2 Description An issue was discovered in the custom/ajax download.php file via the fileName parameter, allowing an attacker to download any file readable by the user www-data from server storage. If the requested...

download.php File Read

The vulnerability in the handler/download.php script of the information system development platform exists due to insufficient checking of the POST parameter filename. Exploiting this vulnerability allows a malicious actor to read the contents of arbitrary files on the server using a specially...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

Sql injection

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

PT-2019-7913

Name of the Vulnerable Software and Affected Versions WebFile Explorer version 1.0 Description The issue allows for Arbitrary File Download remotely. It is related to a SQL Injection vulnerability. The component download.php is affected, specifically the variable $file = $ GET'id'. The attack...

CVE-2017-12761: Improper Neutralization of Special Elements used in an SQL Command

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2019-11611

DoorGets 7.0 is affected by a sensitive information disclosure in /fileman/php/download.php. A remote unauthenticated attacker can exploit this to obtain server‑sensitive information. The connected records corroborate the issue but do not provide the root cause details, affected versions beyond 7...

CVE-2019-11611: Improper Limitation of a Pathname to a Restricted Directory

doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

PT-2019-12418

Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue allows a remote unauthenticated attacker to exploit a sensitive information disclosure vulnerability in the /fileman/php/download.php endpoint to obtain server-sensitive information. Recommendations F...

PT-2019-2176

Name of the Vulnerable Software and Affected Versions Акцент affected versions not specified Description The issue exists due to insufficient checking of the filename POST parameter in the /handlers/download.php script. This allows a remote attacker to read the contents of arbitrary files on the...

Cross site scripting

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...

CVE-2019-7332

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...