CVE-2024-42485

Filament Excel enables excel export for Filament admin resources. The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patched with Version v2.3.3...

CVE-2023-6785 Download Manager <= 3.2.84 - Missing Authorization

The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin even when privately published...

CVE-2023-6785

CVE-2023-6785 affects the Download Manager plugin for WordPress (versions up to and including 3.2.84). The vulnerability allows unauthorized (unauthenticated) users to download files added via the plugin, even if privately published. Root cause details are not provided in the initial description....

CVE-2023-37551

The CVE-2023-37551 issue affects Codesys products where, after user authentication, crafted requests can use the CmpApp component to download files with arbitrary extensions to the controller, bypassing type filtering and potentially compromising the CODESYS Runtime integrity. The attack paths de...

CVE-2022-33913

In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check...

CVE-2022-27192

The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files...

Design/Logic Flaw

The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files...

CVE-2022-27192

The issue (CVE-2022-27192) affects the DVS Avilys document management system, specifically the Reporting module, with versions prior to 3.5.58. The underlying flaw allows an unauthenticated attacker to download arbitrary files and impersonate an administrator by reading administrative files. Affe...

CVE-2022-27192

The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files...

CVE-2021-24692

The CVE concerns the WordPress plugin Simple Download Monitor (before 3.9.5). Affected component: the plugin’s access control/file serving logic allows users with roles as low as Contributor to download arbitrary files from the web server (e.g., wp-config.php) via a path traversal vector. Root ca...

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

Arbitrary file deletion

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

CVE-2021-44586

CVE-2021-44586 concerns dst-admin v1.3.0, where an unauthorized arbitrary file download vulnerability can expose sensitive information. According to NVD, the issue has a Network attack vector with low complexity and no authentication required, exposing partial confidentiality (C:P) and no integri...

Dst-Admin 路径遍历漏洞

Dst-Admin is a Chinese administrative backend for Dont Starve Together Famine Online Edition for the Steam platform. A security vulnerability exists in Dst-Admin v1.3.0, which originates from an unauthorized download of arbitrary files and can expose sensitive information...

Code injection

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213...

CVE-2021-29760

IBM Sterling B2B Integrator Standard Edition versions 5.2.0.0–6.1.1.0 expose an input validation weakness in the dashboard UI that could allow an authenticated user to download unauthorized files. Connected sources (CNVD/CNNVD and IBM bulletin) describe this as an input validation vulnerability a...

CVE-2019-17087

Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under...

CVE-2019-14530

Summary: OpenEMR before 5.0.2 is vulnerable to a local file disclosure via the fileName parameter in custom/ajax_download.php, enabling an authenticated attacker to download files readable by the web server user (www-data) and potentially delete a target file in /var/www/openemr/sites/default/doc...