WordPress Simple Image Manipulator < 1.0 - Local File Inclusion Detection

WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php because no checks are made to authenticate users or sanitize input when determining file location. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Simple Image...

WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion Detection

WordPress MDC YouTube Downloader 2.1.0 plugin is susceptible to local file inclusion. A remote attacker can read arbitrary files via a full pathname in the file parameter to includes/download.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress MDC YouTube Downloader 2.""" import re from...

WordPress Church Admin 0.33.2.1 - Local File Inclusion Detection

WordPress Church Admin 0.33.2.1 is vulnerable to local file inclusion via the "key" parameter of plugins/church-admin/display/download.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Church Admin 0.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Joomla! Component Jw_allVideos - Arbitrary File Retrieval Detection

A directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos JwallVideos plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ modified dot dot in the file parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

Sangfor Application download.php - Arbitary File Read Detection

There is an arbitrary file reading vulnerability in the Sangfor Application download.php. !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the Sangfor Application download.""" import re from kittysploit import from lib.protocols.http.httpclient impo...

WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI) Detection

A directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F encoded dot dot sequences in the url parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in...

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion Detection

WordPress 99 Robots WP Background Takeover Advertisements 4.1.4 is susceptible to local file inclusion via exports/download.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress 99 Robots WP Background Takeover Advertisements 4.""" from kittysploit import from lib.protocols.http.httpclient...

Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access Detection

An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. !/usr/bin/env python3 -- coding: utf-8 -- """An absolute path traversal vulnerability in download.""" import re from...

Swim Team <= v1.44.10777 - Local File Inclusion Detection

The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. !/usr/bin/env python3 -- coding: utf-8 -- """The program /wp-swimteam/include/user/download.""" import re from kittysploit import from lib.protocols.http.httpclient...

WordPress Plugin WP Content Source Control - Directory Traversal Detection

A directory traversal vulnerability in the filegetcontents function in downloadfiles/download.php in the WP Content Source Control wp-source-control plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the path parameter. !/usr/bin/env python3...

WordPress NativeChurch Theme - Local File Inclusion Detection

WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.""" from kittysploit import from lib.protocols.http.httpclient import...

WordPress Oxygen-Theme - Local File Inclusion Detection

WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.php'. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.""" from kittysploit import from...

74cmsSE v3.4.1 - Arbitrary File Read Detection

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php. !/usr/bin/env python3 -- coding: utf-8 -- """74cmsSE v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

CVE-2016-20081: Improper Limitation of a Pathname to a Restricted Directory

WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the filepath parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to acces...

CVE-2026-10581: Server-Side Request Forgery (SSRF)

A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and...

CVE-2018-25408: Improper Limitation of a Pathname to a Restricted Directory

The Open ISES Project 3.30A contains a path traversal vulnerability in the ajax/download.php endpoint that allows unauthenticated attackers to download arbitrary files by manipulating the filename parameter. Attackers can supply directory traversal sequences ../ in the filename parameter to acces...

EUVD-2026-25860

A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and cou...

CVE-2026-7132: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and cou...

PT-2026-35437

A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and cou...

CVE-2026-30996

An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request...