WordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by muhammad yudha Patchstack Alliance in WordPress Plugin Broadcast Live Video versions = 6.2...

WordPress Keep Backup Daily plugin <= 2.1.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Caesar Evan Santoso Patchstack Alliance in WordPress Plugin Keep Backup Daily versions = 2.1.0...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2025-24888

The CVE-2025-24888 issue affects the SecureDrop Client, specifically the API.download_reply() path traversal flaw. The vulnerability arises from using the filename in the Content-Disposition header to write the encrypted reply to disk; although server-side filenames are sanitized, the file can be...

CVE-2025-25243

SAP Supplier Relationship Management Master Data Management Catalog allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or...

SimpleHelp Path Traversal Vulnerability

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords...

CVE-2025-25243

SAP Supplier Relationship Management Master Data Management Catalog allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or...

CVE-2025-25243 Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

SAP Supplier Relationship Management Master Data Management Catalog allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or...

Azure Linux 3.0 Security Update: gh (CVE-2024-54132)

The version of gh installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-54132 advisory. - The GitHub CLI is GitHub's official command line tool. A security vulnerability has been identified in GitHub CL...

PT-2025-6136 · Sap · Sap Supplier Relationship Management

Name of the Vulnerable Software and Affected Versions: SAP Supplier Relationship Management Master Data Management Catalog version 7.52 Description: The issue allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user...

PT-2025-6081 · Unknown · Wandb/Openui

Name of the Vulnerable Software and Affected Versions: wandb/openui version c945bb859979659add5f490a874140ad17c56a5d Description: The issue concerns unauthenticated endpoints that allow file uploads and downloads from an AWS S3 bucket, potentially leading to denial of service, stored XSS, and...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...

CVE-2024-13529

The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialvsenddownloadfile' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers...

CVE-2024-55214

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality...

CVE-2025-25163 WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Zach Swetz Plugin A/B Image Optimizer allows Path Traversal. This issue affects Plugin A/B Image Optimizer: from n/a through 3.3...

CVE-2025-25163 WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through = 3.3...

dhtmlx FileExplorer 安全漏洞

dhtmlx FileExplorer is a JavaScript file system from dhtmlx, Inc. A security vulnerability exists in dhtmlx FileExplorer version v.8.4.6, which originated from a local file inclusion vulnerability that allows remote attackers to obtain sensitive information via the file download feature...

PT-2025-5985 · Unknown · Dhtmlxfileexplorer

Name of the Vulnerable Software and Affected Versions: dhtmlxFileExplorer version 8.4.6 Description: The issue allows a remote attacker to obtain sensitive information through the file download functionality. This is due to a local file inclusion vulnerability. Recommendations: For...

CVE-2024-55214

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...