CVE-2026-81568

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

CVE-2026-81568 Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

CVE-2026-81568

J2Store (Joomla extension by j2commerce.com), versions 1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7 , is vulnerable to arbitrary file read via the task=download endpoint. The root cause is in J2StoreModelOrderdownloads::getFilePath(), which concatenates the configured attachment folder with the stored ...

CVE-2024-33369

Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFileNameFromConnection method in DownloadTask...

PT-2024-25217 · Unknown · Plasmoapp Rpshare Fabric Mod

Name of the Vulnerable Software and Affected Versions: Plasmoapp RPShare Fabric mod version 1.0.0 Description: The issue allows a remote attacker to execute arbitrary code. This is achieved via the getFileNameFromConnection method in DownloadTask. Recommendations: For Plasmoapp RPShare Fabric mod...

Synology Download Station Cross-Site Scripting Vulnerability (CNVD-2015-06011)

Synology Download Station is a set of web-based download applications from Synology. A cross-site scripting vulnerability exists in the 'Create download task via URL' feature in Synology Download Station prior to version 3.5-2967, which can be exploited by remote attackers to inject arbitrary web...