7513 matches found
CVE-2026-75339: Missing Authorization
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...
CVE-2026-75339
The cjbi admin3 v3.0.0 software is vulnerable to a security flaw because the /storage/upload endpoint lacks proper permission checks. This oversight allows any logged-in user to upload arbitrary files to the system, while anonymous attackers can download these files. Direct exploit information or...
CVE-2026-75339
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
PT-2026-82305
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-75413: Files or Directories Accessible to External Parties
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
EUVD-2026-66749
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to an Any File Download flaw. An unauthenticated attacker can utilize the downloadDocEx.do interface to download any file by manipulating the targetPath parameter. This vulnerability allows for unauthorized access to files or directories. No specific remediation, exp...
GHSA-F78G-9385-QXQJ Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...
CVE-2026-66906
The camel-azure-storage-blob component in Apache Camel is vulnerable to a relative path traversal (CWE-22) because the downloadBlobToFile operation fails to perform lexical normalization or boundary checks on remote blob names. When downloading blobs to the directory specified by the fileDir opti...
CVE-2026-28167
Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...
CVE-2026-28167
CVE-2026-28167 is an unauthenticated arbitrary file download vulnerability in the WordPress Super Forms plugin affecting versions 6.3.315 and below . The flaw allows a remote attacker to download arbitrary files from the server without authentication, leading to a high confidentiality impact (CVS...
EUVD-2026-64796
Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...
CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...
CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...
WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by VanTastic in WordPress Plugin Super Forms versions = 6.3.315...
CVE-2026-78212 4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read
4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files...