EUVD-2026-20355

Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through = 3.3.52...

EUVD-2026-12265

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function...

CVE-2025-4367 Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmuserdashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Insecure Direct Object Reference (IDOR)

renolit/reint-downloadmanager is vulnerable to Insecure Direct Object Reference. The vulnerability is due to insufficient access control or validation on the downloaduid parameter in the downloadAction, allowing unauthorized users to directly access files they shouldn’t be able to read...

CVE-2021-34638

Authenticated Directory Traversal in WordPress Download Manager = 3.1.24 allows authenticated Contributor+ users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration informatio...

CVE-2022-2926 Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal

The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory...

Immunity Canvas: WPDM_FILEUPLOAD

Name| wpdmfileupload ---|--- CVE| CWE-434 Exploit Pack| CANVAS Description| wpdmfileupload Notes| CVE Name: CWE-434 VENDOR: wpeden.com Changelog: Notes: WordPress Download Manager WPDM 2.6.92 allows for authenticated users admin, editor, author, contributor, subscriber to delete and upload...