PT-2025-14067 · Unknown · Cm Download Manager

Name of the Vulnerable Software and Affected Versions: CM Download Manager versions n/a through 2.9.6 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows unauthorized access. Recommendations: Update to a...

WordPress plugin CM Download Manager 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2025-24167

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A download's origin may be incorrectly associated...

CVE-2025-24167

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A download's origin may be incorrectly associated...

CVE-2025-24167

CVE-2025-24167 affects Safari and related Apple platforms. The issue stems from incorrect association of a download’s origin due to state-management problems. It is fixed in Safari 18.4, iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4. The CVSS 3.1 vector indicates network access, no user interacti...

WordPress Terms Before Download plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Terms Before Download versions = 1.0.5...

CVE-2025-31614

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through = 1.0.5...

CVE-2025-31614 WordPress Terms Before Download plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through = 1.0.5...

About the security content of Safari 18.4

About the security content of Safari 18.4 This document describes the security content of Safari 18.4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS and Apple iPadOS, which arises from the possibility that download...

WordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Subscribe to Download Lite versions = 1.2.9...

WordPress Include URL plugin <= 0.3.5 Arbitrary File Download Vulnerability

WordPress Include URL plugin = 0.3.5 Arbitrary File Download Vulnerability discovered by timomangcut in WordPress Plugin Include URL versions = 0.3.5...

WordPress Houzez Property Feed plugin <= 2.5.4 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Houzez Property Feed versions = 2.5.4...

Mars: ███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration

A publicly accessible directory containing sensitive WordPress configuration files, including database credentials, authentication keys, and API secrets, was discovered. The vulnerability allowed unauthorized access to critical system information through a downloadable zip file. The security team...

CVE-2025-30785

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through = 1.2.9...

CVE-2024-54291 WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through = 0.9.10...

CVE-2024-54291 WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in NotFound PluginPass allows Manipulating Web Input to File System Calls. This issue affects PluginPass: from n/a through 0.9.10...

CVE-2025-27726

Improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists in the file download process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a...

CVE-2025-27726

The CVE-2025-27726 entry describes a path traversal in the USB storage file-sharing function of the HGW-BL1500HM router (versions 002.002.003 and earlier). The underlying issue allows a crafted HTTP request from a LAN-connected device to obtain and/or alter the product’s files. Affected component...

CVE-2025-27726

Improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists in the file download process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a...