EUVD-2025-12664

Malicious code in bioql PyPI...

EUVD-2021-34183

Malicious code in bioql PyPI...

CVE-2025-30040 Missing authentication in API returning request logs containing session IDs

The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint...

Linux Distros Unpatched Vulnerability : CVE-2021-41281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be...

CVE-2025-54787

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID e.g. attachments. An...

CVE-2025-54787 SuiteCRM: Improper Authorization for attachment downloads

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID e.g. attachments. An...

CVE-2025-34120

CVE-2025-34120 affects LimeSurvey 2.0+ through 2.06+ Build 151014. The issue arises from unvalidated serialized input to the admin backup endpoint (index.php/admin/update/sa/backup), enabling an unauthenticated attacker to craft a datasupdateinfo payload that specifies arbitrary file paths. The v...

CVE-2020-36848 Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to...

CVE-2023-0331

The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server...

CVE-2023-1809

The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files...

CVE-2022-34049

An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data...

CVE-2021-30116

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

SYNCPILOT LIVE CONTRACT 访问控制错误漏洞

SYNCPILOT LIVE CONTRACT is a real-time contract program from SYNCPILOT Germany. A security vulnerability exists in SYNCPILOT LIVE CONTRACT that stems from improper access control of the file download feature, which could result in an unauthenticated user downloading sensitive documents...

WordPress Download Manager plugin <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files vulnerability

Improper Authorization to Unauthenticated Download of Password-Protected Files vulnerability discovered by Emiliano Versini in WordPress Plugin Download Manager versions = 3.3.03...

DEBIAN-CVE-2024-37303

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the...

PT-2024-29982 · Unknown · Filament Excel

Name of the Vulnerable Software and Affected Versions: Filament Excel versions prior to v2.3.3 Description: The export download route "/filament-excel/path" allowed downloading any file without login when the webserver allows ../ in the URL. This issue was reported by Kevin Pohl. Recommendations:...

Westermo EDW-100 安全漏洞

The Westermo EDW-100 is a serial Ethernet converter from Westermo Sweden. A security vulnerability exists in the Westermo EDW-100 version 2024-05-03 and earlier, which originates from allowing an unauthenticated user to download a configuration file containing a password in clear text...

CVE-2023-40276

An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp...

PT-2024-12879 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: An Unauthenticated File Download issue has been discovered in the pharmacy/exportFile.jsp file. This allows unauthorized access to sensitive files. Recommendations: For OpenClinic GA version 5.247.0...

CVE-2023-6785

The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin even when privately published...