EUVD-2026-87897

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization...

Tenda-F3-V4

Tenda F3 ルーター エクスプロイト & ファイルダウンローダー このプロジェクトは、認証不要の脆弱性（CVE-2020-35391）を利用して Tenda F3 ルーター（v3/v4）から各種ファイルをダウンロードするためのツールです。脆弱性のあるルーターから設定ファイル、システムログ、フラッシュダンプを取得できます。 概要 このスクリプトは Tenda F3 ルーターで見つかった脆弱性を悪用し、攻撃者が認証なしで機密ファイルをダウンロードできるようにします。具体的には、以下のファイルをダウンロードできます（パスワード変更機能の追加にも取り組んでいます）： 設定ファイル...

Kaseya VSA < 9.5.7 - Credential Disclosure via Windows Agent

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...

CVE-2023-36144

CVE-2023-36144 CVE-2023-36144のPoC - Intelbras Switch SG 2404 MR L2+ ファームウェア 1.00.54 認証なしでバックアップファイルをダウンロードする 再現手順: 1. 以下のリンクにアクセスする http://127.0.0.1/cgi-bin/exportCfgwithpasswd （127.0.0.1をデバイスのIPに置き換える） 2. バックアップファイルが自動的にダウンロードされ、デバイスの設定、ユーザー、ハッシュ化されたパスワードが含まれている...

CVE-2024-56067

CVE-2024-56067 WP SuperBackup = 2.3.3 - 認可の欠如による未認証バックアップファイルのダウンロード 説明 WordPress用プラグイン「Super Backup & Clone - Migrate for WordPress」は、2.3.3までの全バージョンにおいて、関数の権限チェックが欠如しているため、不正アクセスに対して脆弱です。これにより、未認証の攻撃者がバックアップ全体をダウンロードできる可能性があります。 詳細 タイプ : プラグイン スラッグ : indeed-wp-superbackup 影響を受けるバージョン : 2.3.3...

EUVD-2026-83372

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

CVE-2026-86448

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

PT-2026-93304

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...

CVE-2026-16567

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-16567 Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-16567: Authorization Bypass Through User-Controlled Key

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-19075

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

CVE-2026-66914

CVE-2026-66914 concerns the Joomla extension SEBLOD. Affected versions are SEBLOD &lt; 3.30.0, &lt; 4.7.0, and

CVE-2026-14240: Exposure of Sensitive Information to an Unauthorized Actor

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

Malicious code in warp-drive-internal-tooling (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a62165101225b7ad5371e9310e013a9e1dc69b59a475a7a4ccd7cdf0d7996c1d [email protected] declares a preinstall hook that runs index.js, which on Windows spawns a hidden-window PowerShell process powershe...

MAL-2026-12310 Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

WordPress Simple Backup plugin <= 2.7.11 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by PizzaHatHacker A gmail . com in WordPress Plugin Simple Backup versions = 2.7.11...

CVE-2026-16285 WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID...

CVE-2026-16285: Missing Authorization

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID...