Drupal File Download module < 1.9.0,2.0.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Willem Drupal enthousiast willempje2 in WordPress Module File Download versions 1.9.0,2.0.0...

File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089

The File Download enables you to allow users to download file and image entities directly using a custom field formatter. It also provides an optional submodule to count and display file downloads in Views, similar to how the core statistics module tracks content views. The File Download module...

setuptools: Path Traversal Vulnerability in setuptools PackageIndex

A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of...

CVE-2025-7488

A vulnerability has been found in JoeyBling SpringBootMyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerability affects the function Download of the file /file/download. The manipulation of the argument Name leads to path traversal. The attack can b...

CVE-2025-7625

A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the function Download of the file /download. The manipulation of the argument url leads to path traversal. It is possible to launch the attac...

CVE-2025-51651

An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request...

CVE-2025-51651

An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request...

CVE-2025-7625 YiJiuSmile kkFileViewOfficeEdit download path traversal

A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the function Download of the file /download. The manipulation of the argument url leads to path traversal. It is possible to launch the attac...

CVE-2025-51651

The CVE-2025-51651 issue affects MCCMS v2.7.0, specifically the /admin/Backups.php component. An authenticated attacker can trigger an arbitrary file download by sending a crafted GET request, implying that sensitive files on the server may be exposed. The vulnerability stems from improper access...

PT-2025-29491 · Mccms · Mccms

Name of the Vulnerable Software and Affected Versions: Mccms version 2.7.0 Description: An authenticated arbitrary file download issue exists in the /admin/Backups.php component. Attackers can download arbitrary files by sending a crafted GET request. Recommendations: Apply a fix for Mccms versio...

CVE-2025-51651

An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request...

mccms 安全漏洞

mccms Man City CMS is a rapid website builder system by the individual developer of China Smokey River South chshcms. A security vulnerability exists in mccms version v2.7.0, which originates from the presence of an authenticated arbitrary file download in component /admin/Backups.php, which may...

CVE-2025-51651

An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request...

kkFileViewOfficeEdit 路径遍历漏洞

kkFileViewOfficeEdit is a file online preview and online editing software for OFFICE by YiJiuSmile personal developer. kkFileViewOfficeEdit 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and previous versions of the path traversal vulnerability, the vulnerability stems from the file/download function...

CVE-2025-7488

A vulnerability has been found in JoeyBling SpringBootMyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerability affects the function Download of the file /file/download. The manipulation of the argument Name leads to path traversal. The attack can b...

CVE-2025-7488 JoeyBling SpringBoot_MyBatisPlus download path traversal

A vulnerability has been found in JoeyBling SpringBootMyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerability affects the function Download of the file /file/download. The manipulation of the argument Name leads to path traversal. The attack can b...

CVE-2020-36848 Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to...

SpringBoot_MyBatisPlus 路径遍历漏洞

SpringBootMyBatisPlus is a SpringBoot integration with MyBatisPlus by Siwei Zhou, an individual developer. A path traversal vulnerability exists in SpringBootMyBatisPlus, which stems from path traversal due to incorrect manipulation of the parameter Name in file/file/download...

WordPress RSFirewall! plugin <= 1.1.42 - Authenticated (Admin+) Arbitrary File Read vulnerability

Authenticated Admin+ Arbitrary File Read vulnerability discovered by WordFence in WordPress Plugin RSFirewall! versions = 1.1.42...

WordPress HTML5 Radio Player - WPBakery Page Builder Addon plugin <= 2.5 - Arbitrary File Download vulnerability

WordPress HTML5 Radio Player - WPBakery Page Builder Addon plugin = 2.5 - Arbitrary File Download vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin HTML5 Radio Player - WPBakery Page Builder Addon versions = 2.5...