Arbitrary File Download Vulnerability in Cloud Desktop of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is an industry-leading leader in digital solutions. An arbitrary file download vulnerability exists in the cloud desktop of Xinhua San Technologies Limited, which can be exploited by attackers to download arbitrary files and obtain sensitive information...

WordPress Print Science Designer plugin <= 1.3.155 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Print Science Designer versions = 1.3.155...

CVE-2025-30882

The CVE-2025-30882 entry concerns JS Help Desk for WordPress with an Unauthenticated Path Traversal that allows Arbitrary File Download in versions up to 2.9.1. The vulnerability has a high potential impact (CVSS v3.1: 7.5, Attack Vector Network, Privileges None, User Interaction None) with Confi...

CVE-2024-54291 WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in NotFound PluginPass allows Manipulating Web Input to File System Calls. This issue affects PluginPass: from n/a through 0.9.10...

CVE-2024-13617 Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download

The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server...

CVE-2024-13617

CVE-2024-13617 concerns the aoa-downloadable WordPress plugin (

PT-2025-12756 · WordPress · Aoa-Downloadable

Name of the Vulnerable Software and Affected Versions: aoa-downloadable WordPress plugin version 0.1.0 Description: The issue concerns the aoa-downloadable WordPress plugin, which fails to validate a parameter in its download function. This allows unauthenticated attackers to download arbitrary...

CVE-2024-8501

Summary : CVE-2024-8501 affects the modelscope/agentscope project, specifically the rpc_agent_client component in version v0.0.4. The vulnerability permits an attacker to leverage the download_file method to download arbitrary files from the rpc_agent host. Impact : This can lead to unauthorized ...

CVE-2025-25685

An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25685

CVE-2025-25685 affects GL.iNet Beryl AX GL-MT3000 (v4.7.0). The issue allows attackers to download arbitrary files from the device’s filesystem by adding symbolic links on an external drive that is exposed as a Samba share. Root cause described is related to the handling of symbolic links on the ...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25684

CVE-2025-25684 affects GL.iNet Beryl AX GL-MT3000 (v4.7.0). A lack of validation in the /download path permits arbitrary file download from the device via a crafted POST request. Public references in the dataset confirm the vulnerability class as a path-traversal-like flaw enabling access to the ...

CVE-2025-24521 Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

CVE-2024-55214

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality...

PT-2025-5985 · Unknown · Dhtmlxfileexplorer

Name of the Vulnerable Software and Affected Versions: dhtmlxFileExplorer version 8.4.6 Description: The issue allows a remote attacker to obtain sensitive information through the file download functionality. This is due to a local file inclusion vulnerability. Recommendations: For...

CVE-2021-26608

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash...

CVE-2024-13529 SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download

The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialvsenddownloadfile' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers...