4192 matches found
WordPress Candidate Application Form <= 1.3 - Local File Inclusion
WordPress Candidate Application Form = 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. id: CVE-2015-1000005 info: name: WordPress Candidate Application Form = 1.3 - Local File Inclusion author: dhiyaneshDK severity: high...
WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection
WordPress Easy Digital Downloads plugin 3.1.0.2 and 3.1.0.3 contains a SQL injection vulnerability in the s parameter of its edddownloadsearch action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...
Z-Downloads < 1.11.7 - Cross-Site Scripting
The plugin does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript. id: CVE-2024-8673 info: name: Z-Downloads 1.11.7 - Cross-Site Scripting author: Splint3r7 severity: low description: | The plugin does not properly validate uploaded files...
Easy Digital Downloads - Privilege Escalation
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1. id: CVE-2023-30869 info: name: Easy Digital Downloads - Privilege Escalation author: daffainfo severity: critical...
WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12. id: CVE-2024-5057 info: name: WordPress Easy Digital Downloads = 3.2.12 - SQL Injecti...
Wipro Holmes Orchestrator 20.4.1 - Information Disclosure
Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...
Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download
Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...
axios-ssrf
快速开始 在根目录、后端和前端目录中运行 pnpm install 在根目录中运行 pnpm start:dev 漏洞 本网站已发布在：https://axios-ssrf.onrender.com/ 服务端请求伪造（SSRF）： 我特意使用了一个存在SSRF漏洞的axios版本。 进入搜索栏，输入一个绝对URL，例如 http://example.com 路径遍历： 下载中间件存在路径遍历漏洞。由于这不是传统的控制器，因此SAST工具（semgrep和checkmarx）无法检测到。...
CVE-2025-14783-POC
🧨 CVE-2025-14783: Easy Digital Downloads Account Takeover PoC "La confianza es el fallo de seguridad más explotable." 💀 Descripción Este repositorio contiene una Prueba de Concepto PoC funcional para CVE-2025-14783 , una vulnerabilidad crítica de Password Reset Poisoning Envenenamiento de...
BitLeak
BitLeak BitLeak es una herramienta en Python que verifica y muestra descargas de torrents vinculadas a una dirección IP determinada. root@kitploit: git clone https://github.com/AnkhCorp/BitLeak.git root@kitploit: pip3 install -r requirements.txt root@kitploit: python bitleak.py...
filessh
FileSSH Un explorador de archivos basado en TUI para servidores SSH, que te permite navegar y gestionar archivos en un servidor remoto, editarlos en el mismo lugar y descargar directorios de forma recursiva con recorrido paralelo de directorios. También tiene la capacidad de iniciar rápidamente...
CVE-2026-74975
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the Downloads component in Firefox for Android...
CVE-2026-74980
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in the Downloads component in Firefox for Android...
CVE-2026-74950
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Downloads API component...
CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android...
Linux Distros Unpatched Vulnerability : CVE-2026-74980
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. CVE-2026-74980 Note that Nessus relies on the...
CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This...
Linux Distros Unpatched Vulnerability : CVE-2026-74950
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
