CVE-2025-5381 Yifang CMS Admin Panel downloadFile path traversal

A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possible to launch the attack...

PT-2025-23406 · Unknown · Yifang Cms

Name of the Vulnerable Software and Affected Versions: Yifang CMS versions up to 2.0.2 Description: A vulnerability was found in the function downloadFile of the file "/api/File/downloadFile" of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possib...

Yifang CMS 路径遍历漏洞

Yifang CMS is a PHP enterprise website development and construction management system from China Yifang Company. A security vulnerability exists in Yifang CMS 2.0.2 and earlier versions, which stems from path traversal due to incorrect operation of the File parameter File in...

External Control of File Name or Path

Overview Microsoft.Build.Tasks.Core is a This package contains the Microsoft.Build.Tasks assembly which implements the commonly used tasks of MSBuild. Affected versions of this package are vulnerable to External Control of File Name or Path due to the external control of file name or path. An...

CVE-2025-28028

TOTOLINK A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter...

CVE-2025-28022

TOTOLINK A810R V4.1.2cu.5182B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter...

CVE-2025-28020

TOTOLINK A800R V4.1.2cu.5137B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter...

CVE-2025-28027

Several TOTOLINK router models are susceptible to a stack-based buffer overflow vulnerability within the downloadFile.cgi script. The affected products include A830R (V4.1.2cu.5182_B20201102), A950RG (V4.1.2cu.5161_B20200903), A3000RU (V5.9c.5185_B20201128), and A3100R (V4.1.2cu.5247_B20211129). ...

Arbitrary File Upload

Overview alexstack/laravel-cms is a Simple Bootstrap Laravel CMS Affected versions of this package are vulnerable to Arbitrary File Upload due to unchecked access to the downloadFile function in index in LaravelCmsFileAdminController.php. Remediation There is no fixed version for...

CVE-2024-7741

A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfile of the component API Endpoint. The manipulation of the argument file leads to path traversal. The attack may be initiated remotely. The...

CVE-2024-7741

A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfile of the component API Endpoint. The manipulation of the argument file leads to path traversal. The attack may be initiated remotely. The...

CVE-2024-7741 wanglongcn ltcms API Endpoint downloadfile downloadFile path traversal

A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfile of the component API Endpoint. The manipulation of the argument file leads to path traversal. The attack may be initiated remotely. The...

PT-2024-38549 · Wanglongcn · Ltcms

Name of the Vulnerable Software and Affected Versions: wanglongcn ltcms version 1.0.20 Description: A critical issue affects the downloadFile function of the /api/file/downloadfile API Endpoint, where manipulation of the file argument leads to path traversal. This issue can be initiated remotely...

PT-2024-5008 · NetGear · Netgear Wn604

Name of the Vulnerable Software and Affected Versions: Netgear WN604 versions up to 20240710 Description: A vulnerability was found in the Web Interface component of Netgear WN604, specifically in the /downloadFile.php file. The issue is related to insufficient protection of internal data. The...

WordPress Plugin almosteffortless secure-files path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...

There is an RCE vulnerability

Description - There is an RCE vulnerability in qmpaas/leadshop https://github.com/qmpaas/leadshop v1.4.15. An attacker can access the file leadshop.php and call any existing function through GET to control the target host. The vulnerability is in the leadshop/web/leadshop.php27-61 file public...

CVE-2022-40475

The TOTOLINK A860R wireless router (version V4.1.2cu.5182_B20201027 ) is vulnerable to command injection via the /cgi-bin/downloadFile.cgi component. The root cause is the component's failure to properly filter special characters and commands. An attacker can exploit this to achieve arbitrary com...

CVE-2022-37840

In TOTOLINK A860R V4.1.2cu.5182B20201027, the main function in downloadfile.cgi has a buffer overflow vulnerability...

CVE-2021-3485

An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Securit...

CVE-2021-3485

An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Securit...