7838 matches found
CVE-2018-25178
CVE-2018-25178 affects Easyndexer 1.0 and describes an arbitrary file download vulnerability in showtif.php. The issue allows unauthenticated attackers to download sensitive files by sending POST requests with arbitrary file paths in the file parameter, enabling access to configuration and initia...
CVE-2018-25164 EverSync 0.5 Arbitrary File Download via files Directory
EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application...
CVE-2018-25164
CVE-2018-25164 affects EverSync 0.5, enabling unauthenticated arbitrary file download via the files directory. The vulnerability allows direct GET requests to download sensitive files (e.g., database file db.sq3) containing application data and credentials. Reported CVSS scores indicate high impa...
CVE-2018-25164
EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application...
CVE-2018-25164 EverSync 0.5 Arbitrary File Download via files Directory
EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application...
CVE-2018-25178: Improper Limitation of a Pathname to a Restricted Directory
Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like...
CVE-2018-25164: Files or Directories Accessible to External Parties
EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application...
Easyndexer 路径遍历漏洞
Easyndexer is a database interface software developed by rul10’s individual developer. Version 1.0 of Easyndexer has a path traversal vulnerability. This vulnerability stems from the file parameter in the showtif.php file, which allows arbitrary file downloads, potentially leading to the download...
Musicco 路径遍历漏洞
Musicco is a music management system developed by Musicco Inc. Version 2.0.0 of Musicco has a path traversal vulnerability. This vulnerability stems from a path traversal issue with the parent parameter, which may allow unverified attackers to download files from arbitrary directories...
PT-2026-23676
EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application...
PT-2026-23690
Name of the Vulnerable Software and Affected Versions Easyndexer version 1.0 Description The software contains a flaw that allows unauthenticated attackers to download sensitive files. This is achieved by manipulating the file parameter within POST requests sent to the ''showtif.php'' endpoint...
CVE-2026-28078 WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through = 2.2.0...
CVE-2026-28078 WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through = 2.2.0...
CVE-2026-28078
CVE-2026-28078 describes an Improper Pathname Limitation (Path Traversal) in the WordPress plugin uListing (Stylemix uListing, listing component) that allows arbitrary file download. Affected: uListing versions from unspecified earlier up to and including 2.2.0. The initial description and Red Ha...
CVE-2025-69411 WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through = 1.3...
CVE-2025-69411 WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through = 1.3...
CVE-2025-69411
CVE-2025-69411 pertains to the ionCube tester plus WordPress plugin (ioncube-tester-plus) and is an authenticated? no—unauthenticated arbitrary file download via path traversal. The Nuclei template confirms Local File Inclusion/Arbitrary File Read via the loader-wizard.php parameter 'ininame' in ...
DRUPAL-CONTRIB-2026-020
This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook\file\download when a custom or contrib module implements that hook leading to access bypass...
WordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin ionCube tester plus versions = 1.3...
