CVE-2022-2633: Externally Controlled Reference to a Resource in Another Sphere

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

Casdoor IAM SSO File Download Execution

The vulnerability of the IAM and SSO Casdoor platform lies in its ability to allow unlimited loading of malicious files. Exploiting this vulnerability could enable a malicious actor, operating remotely, to load and execute any file on the target system...

CVE-2021-45027

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

CVE-2021-45027

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

CVE-2021-45027

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

Input validation

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

CVE-2021-45027

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...

CVE-2021-45027

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function, allowing an unauthenticated attacker to read arbitrary files on Windows servers (e.g., win.ini) through unsanitized input in the fileName parameter. Affected lineage from CV...

CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

Arbitrary file deletion

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

CVE-2022-36671

CVE-2022-36671 affects Novel-Plus v3.6.2, with an arbitrary file download vulnerability exposed via the background file download API. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a network-based, unauthenticated issue with high impact to confidentiality and no impact on integri...

CVE-2022-36671

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

PT-2022-23541 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus version 3.6.2 Description: The issue allows for an arbitrary file download via the "background file download API". Recommendations: For Novel-Plus version 3.6.2, consider restricting access to the background file download API until...

CVE-2022-36671: Download of Code Without Integrity Check

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

PT-2022-12293 · Unknown · Oliver V5 Library Server

Name of the Vulnerable Software and Affected Versions: Oliver v5 Library Server versions prior to 5.00.008.053 Description: The issue allows for arbitrary file download by an attacker using unsanitized user-supplied input via the FileServlet function. Recommendations: For versions prior to...

Novel-plus security vulnerabilities

novel-plus novel-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus v3.6.2, which can be exploited to download arbitrary files via the background file download API...

Softlink Oliver v5 Library Server security vulnerability

Softlink Oliver v5 Library Server is an easy-to-use library management and learning tool from Softlink. A security vulnerability exists in Softlink Oliver v5 Library Server version 5.00.008.053, which originates from a FileServlet function that allows an attacker to download arbitrary files using...

CVE-2021-45027: Download of Code Without Integrity Check

An arbitrary file download vulnerability in Oliver v5 Library Server Versions 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input...