CVE-2025-56231

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections...

CVE-2025-56231

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections...

EUVD-2025-37933

Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections...

CVE-2025-56231

Tonec Internet Download Manager (IDM) 6.42.41.1 and earlier is affected by a Missing SSL Certificate Validation vulnerability in the update mechanism, allowing a remote attacker to bypass update protections. Affected component is the update/SSL validation routine; root cause details are consisten...

PT-2025-45386

Name of the Vulnerable Software and Affected Versions Jellysweep versions 0.12.1 and below Description Jellysweep is a cleanup tool for the Jellyfin media server. The /api/images/cache API endpoint accepts a URL parameter that is directly passed to a cache package, allowing the server to download...

WordPress Import WP plugin <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read vulnerability

Authenticated Admin+ Arbitrary File Read vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Import WP versions = 2.14.16...

EUVD-2025-37546

Malicious code in dowloadebokbeforedawnvampirefallenbook1bymorganricefjwc4 npm...

EUVD-2025-37543

Malicious code in dowloadebokteufelsbotschaftosterreichkrimimeierhoferssebylisagallauner07297 npm...

Path Traversal

invokeai is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of filename/path parameters due to the GET /api/v1/images/download/bulkdownloaditemname endpoint accepting user-controlled paths without canonicalization or sanitization. An an attacker can craft request...

Astra Linux – Vulnerability in Thunderbird

An HTML email containing links to .pdf files can trigger automatic, unsolicited downloads of those files to the user’s desktop or home directory without any prompts, even if auto-saving is disabled. This behavior can be exploited to fill the disk with junk data e.g., using /dev/urandom on Linux o...

Directory Traversal

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to Directory Traversal via the isvalidpath method. An attacker can download arbitrary files via the...

CVE-2018-25122

Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inje...

CVE-2020-36867

Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped,...

CVE-2025-46363

Dell Secure Connect Gateway SCG 5.0 Application and Appliance versions 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG exposed for an internal collection download REST API if this REST API is enabled by Admin user from UI. A low privileged attacker with remote...

CVE-2025-12041 ERI File Library <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download

The ERI File Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eriflfile' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download files restricted to specific user...

CVE-2025-12041

The CVE-2025-12041 entry concerns the WordPress ERI File Library plugin up to version 1.1.0, where a missing capability check on the erifl_file AJAX action allows unauthenticated attackers to download files restricted to specific user roles. Affected software: WordPress ERI File Library plugin (v...

WordPress WooCommerce Designer Pro plugin <= 1.9.28 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by István Márton in WordPress Plugin WooCommerce Designer Pro versions = 1.9.28...

WordPress Zombify plugin <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Subscriber+ Path Traversal to Arbitrary File Read vulnerability discovered by Tonn in WordPress Plugin Zombify versions = 1.7.5...

EUVD-2018-21609

Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inje...

CVE-2020-36867

Nagios XI versions prior to 5.7.3 contain a command injection vulnerability in the report PDF download/export functionality. User-supplied values used in the PDF generation pipeline or the wrapper that invokes offline/pdf helper utilities were insufficiently validated or improperly escaped,...