PT-2026-23690

Name of the Vulnerable Software and Affected Versions Easyndexer version 1.0 Description The software contains a flaw that allows unauthenticated attackers to download sensitive files. This is achieved by manipulating the file parameter within POST requests sent to the ''showtif.php'' endpoint...

CVE-2026-28078 WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through = 2.2.0...

CVE-2026-28078

CVE-2026-28078 describes an Improper Pathname Limitation (Path Traversal) in the WordPress plugin uListing (Stylemix uListing, listing component) that allows arbitrary file download. Affected: uListing versions from unspecified earlier up to and including 2.2.0. The initial description and Red Ha...

CVE-2026-28078 WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through = 2.2.0...

CVE-2025-69411 WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through = 1.3...

CVE-2025-69411

CVE-2025-69411 pertains to the ionCube tester plus WordPress plugin (ioncube-tester-plus) and is an authenticated? no—unauthenticated arbitrary file download via path traversal. The Nuclei template confirms Local File Inclusion/Arbitrary File Read via the loader-wizard.php parameter 'ininame' in ...

CVE-2025-69411 WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through = 1.3...

DRUPAL-CONTRIB-2026-020

This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook\file\download when a custom or contrib module implements that hook leading to access bypass...

WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin ionCube tester plus versions = 1.3...

CVE-2024-55019

Incorrect access control in the component downloadwb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files...

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hookfiledownload when a custom or contrib module implements that hook leading to access bypass...

CVE-2024-55019

Incorrect access control in the component downloadwb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files...

CVE-2024-55019

Incorrect access control in the component downloadwb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files...

CVE-2024-55019

Incorrect access control in the component downloadwb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files...

CVE-2024-55019

Incorrect access control in the component downloadwb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files...

PT-2026-22776

Incorrect access control in the component download wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files...

CVE-2024-55019

Incorrect access control in the component downloadwb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files...

CVE-2024-55019

Weintek cMT-3072XH2 easyweb Web Version v2.1.53 (OS v20231011) contains an access-control flaw in the download_wb.cgi component that allows unauthenticated users to download arbitrary files. The vulnerability is tied to incorrect access control in the relevant web interface, enabling potential da...

PT-2026-22546

Name of the Vulnerable Software and Affected Versions IDExpert Windows Logon Agent affected versions not specified Description IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution issue. Unauthenticated remote attackers can force the system to download arbitrary executab...

PT-2026-22992

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.61.0 Description File Browser provides a file managing interface. A directory traversal issue exists in public share links prior to version 2.61.0. The withHashFile middleware in http/public.go incorrectly uses...