WordPress Candidate Application Form <= 1.3 - Local File Inclusion

WordPress Candidate Application Form = 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. id: CVE-2015-1000005 info: name: WordPress Candidate Application Form = 1.3 - Local File Inclusion author: dhiyaneshDK severity: high...

Wordpress candidate-application-form plugin file download vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. candidate-application-form is one of the plugins used to add a candidate application form to a job opening. A file download vulnerability exists in version v1.0 of the Wordpress...

CVE-2015-1000005

Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin...

CVE-2015-1000005

CVE-2015-1000005 affects the WordPress plugin Candidate Application Form (v1.0;

WordPress Candidate Application Form Plugin 1.0 - Arbitrary File Download

Candidate Application Form plugin is prone to an arbitrary file download vulnerability via "downloadpdffile.php". It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Update the plugin...

WordPress Plugin Candidate Application Form 1.0 - Arbitrary File Download

WordPress Plugin Candidate Application Form 1.0 - Arbitrary File Download Title: Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-12 Download Site: https://wordpress.org/plugins/candidate-application-form...

WordPress Candidate Application Form 1.0 File Download

Title: Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-12 Download Site: https://wordpress.org/plugins/candidate-application-form Vendor: https://profiles.wordpress.org/flaxlandsconsulting/ Vendor Notified:...

Candidate Application Form <= 1.3 - Unauthenticated Arbitrary File Download

Plugin is still affected and has been closed. The code in downloadpdffile.php does not do any sanity checks, allowing a remote attacker to download sensitive system files. PoC $ curl...