EUVD-2020-30943

HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepath and filename parameters. Attackers can send crafted GET requests to download.asp with directory traversal to access sensitive configuration and system file...

CVE-2020-37034

HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepath and filename parameters. Attackers can send crafted GET requests to download.asp with directory traversal to access sensitive configuration and system file...

CVE-2020-37034 HelloWeb 2.0 - Arbitrary File Download

HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepath and filename parameters. Attackers can send crafted GET requests to download.asp with directory traversal to access sensitive configuration and system file...

CVE-2020-37034

HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepath and filename parameters. Attackers can send crafted GET requests to download.asp with directory traversal to access sensitive configuration and system file...

CVE-2020-37034 HelloWeb 2.0 - Arbitrary File Download

HelloWeb 2.0 contains an arbitrary file download vulnerability that allows remote attackers to download system files by manipulating filepath and filename parameters. Attackers can send crafted GET requests to download.asp with directory traversal to access sensitive configuration and system file...

CVE-2020-37034

CVE-2020-37034 concerns HelloWeb 2.0 with an arbitrary file download vulnerability. The affected component is the download.asp endpoint where an attacker can manipulate the filepath and filename parameters (directory traversal) to access sensitive configuration and system files. Descriptions acro...

mtkclient

🚀 mtkclient - Easily Flash and Repair Mediatek Devices !Dow...

PT-2026-5475

Name of the Vulnerable Software and Affected Versions HelloWeb version 2.0 Description The software contains an arbitrary file download issue that enables remote attackers to download system files. This is achieved by manipulating the filepath and filename parameters within crafted GET requests...

Hello, Web path traversal vulnerability

Hello Web is a self-service website building tool provided by Hello Web Inc. The Hello Web 2.0 version has a path traversal vulnerability, which stems from improper handling of the filepath and filename parameters in the download.asp page. This vulnerability could lead to the download of arbitrar...

CVE-2025-57795

Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution...

CVE-2026-24685

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint /projects/:projectid/repository/diff.diff when rendering a single revision via git show. By...

CVE-2026-1060

The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permissioncallback set to returntrue, allowing unauthenticated attacke...

CVE-2020-37015

The Ruijie Networks Switch eWeb S29RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can exploit the /download.do endpoint with '../' sequences to retrieve...

CVE-2020-37015

CVE-2020-37015 affects Ruijie Networks Switch eWeb S29_RGOS 11.4. The vulnerability is a directory traversal in the web interface where an unauthenticated user can manipulate the file path on the /download.do endpoint using ’../’ sequences to retrieve sensitive configuration files that may contai...

EUVD-2020-30919

Ruijie Networks Switch eWeb S29RGOS 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can exploit the /download.do endpoint with '../' sequences to retrieve system...

CVE-2020-37015

The Ruijie Networks Switch eWeb S29RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can exploit the /download.do endpoint with '../' sequences to retrieve...

CVE-2020-37015 Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal

The Ruijie Networks Switch eWeb S29RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can exploit the /download.do endpoint with '../' sequences to retrieve...

CVE-2020-37015 Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal

The Ruijie Networks Switch eWeb S29RGOS version 11.4 contains a directory traversal vulnerability that allows unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can exploit the /download.do endpoint with '../' sequences to retrieve...

PT-2026-5289

Name of the Vulnerable Software and Affected Versions Ruijie Networks Switch eWeb S29 RGOS version 11.4 Description The software contains a directory traversal flaw that permits unauthenticated attackers to access sensitive configuration files by manipulating file path parameters. Attackers can...

Ruijie Switch eWeb S29_RGOS path traversal vulnerability

Ruijie Switch eWeb S29RGOS is a web management interface system developed by the Chinese company Ruijie. The version 11.4 of Ruijie Switch eWeb S29RGOS contains a path traversal vulnerability. This vulnerability stems from the /download.do endpoint, which allows for directory traversal, potential...