CVE-2026-111652 Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/ paths for .jpg, .png, .bmp, or .mp4 files, which are...

CVE-2026-111652

Versions of Engineercms through 2.0.5 are vulnerable to a missing authorization flaw in AttachController.Attachment . This vulnerability allows unauthenticated attackers to download project image and video attachments (specifically .jpg , .png , .bmp , and .mp4 files) by requesting known or deriv...

CVE-2026-111652 Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/ paths for .jpg, .png, .bmp, or .mp4 files, which are...

CVE-2026-25787

Affected devices do not properly validate and sanitize Technology Object TO name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the...

PT-2026-39985

Affected devices do not properly validate and sanitize Technology Object TO name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the...

CVE-2024-5548

A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'projectname' parameter in a GET request to download arbitrary files from the system. This issue...

CVE-2024-5547

A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'projectname' parameter in the downloadprojectpdf function. Attackers can exploit...

CVE-2024-5548: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'projectname' parameter in a GET request to download arbitrary files from the system. This issue...

PT-2014-8869

Name of the Vulnerable Software and Affected Versions Smarty Pants Plugins SP Project & Document Manager plugin versions 2.4.1 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the vendor email parameter in the email vendor...

CVE-2009-1627

Stack-based buffer overflow in Streaming Download Project SDP Downloader 2.3.0 allows remote attackers to execute arbitrary code via a long .asf URL in the HREF attribute of a REF element in a .asx file...

CVE-2009-1627: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in Streaming Download Project SDP Downloader 2.3.0 allows remote attackers to execute arbitrary code via a long .asf URL in the HREF attribute of a REF element in a .asx file...