115 matches found
CVE-2023-36144
CVE-2023-36144 PoC of CVE-2023-36144 - Intelbras Switch SG 2404 MR L2+ firmware 1.00.54 Download the backup file unauthenticated Steps to Reproduce: 1. Go to the following link http://127.0.0.1/cgi-bin/exportCfgwithpasswd replace 127.0.0.1 with the device IP 2. It will auto download the backup...
CVE-2024-56067
CVE-2024-56067 WP SuperBackup = 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and...
Tenda-F3-V4
Tenda F3 Router Exploit & File Downloader This project is a tool for downloading various files from the Tenda F3 router v3/v4 through an unauthenticated vulnerability CVE-2020-35391. It allows you to get the configuration file, system log, and flash dump from a vulnerable router. Overview The...
Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...
EUVD-2026-87897
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization...
EUVD-2026-83372
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...
CVE-2026-86448
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...
PT-2026-93304
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...
CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-16567
The Document Embedder WordPress plugin, in versions before 2.3.1 , is vulnerable to an unauthenticated private document download. The flaw occurs because the plugin fails to verify a document's status before issuing a download token and streaming the file. This allows an unauthenticated attacker ...
CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
CVE-2026-16567: Authorization Bypass Through User-Controlled Key
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...
GO-2026-6268 Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...
PT-2026-82023
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-66914
CVE-2026-66914 concerns the Joomla extension SEBLOD. Affected versions are SEBLOD < 3.30.0, < 4.7.0, and
CVE-2026-14240: Exposure of Sensitive Information to an Unauthorized Actor
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...
Malicious code in warp-drive-internal-tooling (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a62165101225b7ad5371e9310e013a9e1dc69b59a475a7a4ccd7cdf0d7996c1d [email protected] declares a preinstall hook that runs index.js, which on Windows spawns a hidden-window PowerShell process powershe...
MAL-2026-12310 Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...
WordPress Simple Backup plugin <= 2.7.11 - Unauthenticated Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download vulnerability discovered by PizzaHatHacker A gmail . com in WordPress Plugin Simple Backup versions = 2.7.11...