CVE-2025-5986

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urandom on Linux or to...

UBUNTU-CVE-2025-5986

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urandom on Linux or to...

CVE-2025-4799

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above,...

CVE-2025-4798

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10. This is due to a lack of restriction on the directory an administrator can select for storing downloads. This makes it possible for authenticated attackers, with...

WordPress WP-DownloadManager plugin <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read vulnerability

Authenticated Administrator+ Arbitrary File Read vulnerability discovered by Jamshed Yergashvoyev CVE Guy in WordPress Plugin WP-DownloadManager versions = 1.68.10...

WordPress plugin WP-DownloadManager 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

Rail Pass Management System /download-pass.php File SQL Injection Vulnerability

Rail Pass Management System is a rail pass management system. The Rail Pass Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter searchdata in the file /download-pass.php. An attacker can...

CVE-2025-5975

A vulnerability, which was classified as problematic, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /rpms/download-pass.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotel...

CVE-2025-5975 PHPGurukul Rail Pass Management System download-pass.php cross site scripting

A vulnerability, which was classified as problematic, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /rpms/download-pass.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotel...

June 10, 2025—Hotpatch KB5060525 (OS Build 20348.3745)

None None...

KB5060954: Servicing stack update for Windows 10, version 1607 and Windows Server 2016: June 10, 2025

None None...

PT-2025-24929 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A problematic issue was found in the PHPGurukul Rail Pass Management System, affecting an unknown part of the file /rpms/download-pass.php. The manipulation of the searchdata...

RHEL 8 : thunderbird (RHSA-2025:8784)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:8784 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment...

Mozilla Thunderbird < 139.0.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 139.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-50 advisory. - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the...

VulnCheck KEV: CVE-2025-20188

A vulnerability in the Out-of-Band Access Point AP Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected...

PHPGurukul Rail Pass Management System 代码注入漏洞

Rail Pass Management System is a rail pass management system. The Rail Pass Management System suffers from a cross-site scripting vulnerability that stems from improper handling of the searchdata parameter in the /rpms/download-pass.php file. An attacker could use this vulnerability to inject a...

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in Thunderbird CVE-2025-3875 thunderbird: Unsolicited File Download,...

HPESBNW04883 rev.1 - HPE Aruba Networking Private 5G Core, Exposure of Sensitive Information to Unauthorized Users

Potential Security Impact: Remote: Arbitrary File Download, Unauthorized Access to Files SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Aruba Networking Private 5G Core Any versions between 1.24.1.0 and 1.25.1.0 and below - HPE recommends to deploy the product so that the API...

ALSA-2025:8756 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in Thunderbird CVE-2025-3875 thunderbird: Unsolicited File Download,...

CVE-2025-31635

CVE-2025-31635: WordPress CLEVER plugin ≤ 2.6 contains an unauthenticated path traversal vulnerability enabling arbitrary file download. The issue stems from improper pathname handling in the CLEVER plugin, allowing access to restricted files. Public references corroborate affected versions as “n...