WordPress plugin CF7 File Download – File Download for CF7 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin CF7 File Download - A...

WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Download vulnerability

Limited Arbitrary File Download vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin XStore Core versions = 5.3.8...

WordPress Element Pack Pro Plugin <= 7.7.4 is vulnerable to Arbitrary File Download

Software Element Pack Pro Type Plugin Vulnerable versions = 7.7.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-33568 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 6b262cd1989a Credits Rafie Muhammad Patchstack...

WordPress XStore Core Plugin <= 5.3.8 is vulnerable to Arbitrary File Download

Software XStore Core Type Plugin Vulnerable versions = 5.3.8 Fixed in 5.3.9 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-33558 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 535d5071f992 Credits Rafie Muhammad Patchstack...

SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR

Description The plugin lacks proper access controllers and allows a logged in user to view and download files belonging to another user As a logged in user, send a GET request: GET /wp-admin/admin-ajax.php?action=cdmfilelist&uid=3CHANGE HERE&pid=0CHANGE HERE&search=&=1708406394720 You can view...

Forminator Plugin Arbitrary File Upload

The vulnerability of the Forminator plugin of the WordPress content management system is related to the ability to download unlimited files of a dangerous type. Exploiting this vulnerability allows a malicious actor to download any files onto the server...

WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability

Arbitrary File Download and Deletion vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Sendinblue for WooCommerce versions = 4.0.17...

WordPress ChatBot Conversational Forms plugin <= 1.1.8 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Conversational Forms for ChatBot versions = 1.1.8...

WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Olive One Click Demo Import versions = 1.1.1...

WordPress BuddyForms Plugin <= 2.8.8 is vulnerable to Arbitrary File Download

Software BuddyForms Type Plugin Vulnerable versions = 2.8.8 Fixed in 2.8.9 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32830 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID df4ae0005bef Credits Yudistira Arya Required privilege...

WordPress Conversational Forms for ChatBot Plugin <= 1.1.8 is vulnerable to Arbitrary File Download

Software Conversational Forms for ChatBot Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.2.0 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-32729 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 27e83c0724e4 Credits Yudistira...

WordPress Olive One Click Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File Download

Software Olive One Click Demo Import Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32715 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID a4c06fc8a3c4 Credits Yudistira Arya...

WordPress Sendinblue for WooCommerce Plugin <= 4.0.17 is vulnerable to Arbitrary File Download

Software Sendinblue for WooCommerce Type Plugin Vulnerable versions = 4.0.17 Fixed in 4.0.18 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32807 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 1a6d8c4d6ed3 Credits Yudistira Arya...

CVE-2024-31552

CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the server and obtain sensitive information...

CuteHttpFileServer 安全漏洞

CuteHttpFileServer chfs is a file sharing server from chfs open source. A security vulnerability exists in CuteHttpFileServer version v.3.1, which stems from the presence of an arbitrary file download vulnerability. An attacker can exploit this vulnerability to download arbitrary files on the...

Arbitrary File Download Vulnerability in Intelligent Park Comprehensive Management Platform of Zhejiang Dahua Technology Company Limited (CNVD-2024-23621)

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. Zhejiang Dahua Technology Co., Ltd. intelligent park integrated management platform has an arbitrary file download vulnerability, which can be exploited by...

CVE-2024-31552: Improper Limitation of a Pathname to a Restricted Directory

CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the server and obtain sensitive information...

PT-2024-24138 · Unknown · Cute Http File Server

Name of the Vulnerable Software and Affected Versions: CuteHttpFileServer version 3.1 Description: The issue allows attackers to download arbitrary files on the server, potentially obtaining sensitive information. Recommendations: For CuteHttpFileServer version 3.1, update to a version that fixes...

CVE-2024-31587: Improper Limitation of a Pathname to a Restricted Directory

SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request...

CVE-2024-31552

CuteHttpFileServer version v.3.1 is susceptible to an arbitrary file download vulnerability. This flaw stems from an improper limitation of a pathname to a restricted directory , which allows an attacker to download arbitrary files from the server. Successful exploitation can lead to the disclosu...