PT-2025-11207 · Unknown · Sante Pacs Server.Exe

Name of the Vulnerable Software and Affected Versions: Sante PACS Server.exe affected versions not specified Description: A Path Traversal Information Disclosure issue exists in Sante PACS Server.exe, allowing an unauthenticated remote attacker to download arbitrary files on the disk drive where...

Santesoft Sante PACS Server 安全漏洞

Santesoft Sante PACS Server is a DICOM 3.0 compliant PACS server, Modality Worklist server, HTTP Web server for DICOM files, and CD/DVD burning and printing server from Santesoft Cyprus. Used to store, archive, manage, view and burn medical images. A security vulnerability exists in Santesoft San...

WordPress plugin Download Manager 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress Download Manager plugin <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite vulnerability

Authenticated Author+ Path Traversal to Limited File Overwrite vulnerability discovered by zhuxuan wu in WordPress Plugin Download Manager versions = 3.3.08...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Updated to Mozilla Thunderbird 128.8 MFSA 2025-18 bsc1237683: CVE-2024-43097: Overflow when growing an SkRegion's RunArray CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in the Browser process CVE-2025-1931:...

CVE-2025-1508

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downloaddata action in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to download...

CVE-2025-1508 WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downloaddata action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to download...

WordPress plugin WP Crowdfunding 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress WP Crowdfunding plugin <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download vulnerability

Missing Authorization to Authenticated Subscriber+ Post Content Download vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Crowdfunding versions = 2.1.14...

CVE-2025-22369 Mennekes smart/premium charges systems, Arbitrary file download using ReadFile endpoint

The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS...

CVE-2025-22369 Mennekes smart/premium charges systems, Arbitrary file download using ReadFile endpoint

The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS...

Description of the security update for Office Online Server: March 11, 2025 (KB5002690)

None None...

WordPress Download Manager plugin <= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory vulnerability

Unauthenticated Information Disclosure via Unprotected Directory vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Download Manager versions = 3.3.06...

com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public

Impact The homepage of the application is public which enables a guest to download the package which might contain sensitive information. Patches 1.11.7 Workarounds The access to the page can be manually restricted to a specific set of users or groups...

CVE-2025-27604 XWiki Confluence Migrator Pro's homepage is public

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7...

CVE-2025-21095

Path traversal may lead to arbitrary file download. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

CVE-2025-24521

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

CVE-2024-10804 Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download

The Ultimate Video Player WordPress & WooCommerce Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 10.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the...

WordPress Ultimate Video Player plugin <= 10.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Tonn in WordPress Plugin Ultimate Video Player versions = 10.0...

Smartwares CIP-37210AT和Smartwares C724IP 安全漏洞

The Smartwares CIP-37210AT and Smartwares C724IP are both products of Smartwares, Inc.The Smartwares CIP-37210AT is an IP camera device for home or office security monitoring.The Smartwares C724IP is an IP camera device that is for home or office security monitoring. A security vulnerability exis...