9 matches found
CVE-2026-14925: Exposure of Sensitive Information to an Unauthorized Actor
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...
CVE-2026-14235 WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...
EUVD-2022-42680
Malicious code in bioql PyPI...
CVE-2022-3284
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
CVE-2022-3284
CVE-2022-3284 affects M-Files New Web versions prior to 22.11.12011.0, where the download key for a vault file was passed insecurely and could be logged. Multiple sources (NVD, Red Hat, PRION, CNNVD, PT-Security) corroborate this issue and specify impact to confidentiality (high) with no integrit...
CVE-2022-3284 Insecure way of passing a download key
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
CVE-2022-3284 Insecure way of passing a download key
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
M-Files 安全漏洞
M-Files is an innovative metadata-driven document management platform from M-Files, Inc. A security vulnerability exists in versions prior to M-Files New Web 22.11.12011.0 that stems from the download key for a file in the vault being passed in an insecure manner, which can be easily logged...
