CVE-2025-26779 WordPress Keep Backup Daily plugin <= 2.1.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path Traversal.This issue affects Keep Backup Daily: from n/a through = 2.1.0...

MAL-2025-191803 Malicious code in network-utils-simple (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1fd943d3243197ac153b2623548e62b4225a59f611cf13fe962bc3ced369a32d During installation, there is an attempt to download and execute code. The package has no real functionality. --- Category: MALICIOUS - The campaign has clearl...

WordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by muhammad yudha Patchstack Alliance in WordPress Plugin Broadcast Live Video versions = 6.2...

CVE-2025-23786

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DuoGeek Email to Download email-to-download allows Reflected XSS.This issue affects Email to Download: from n/a through = 3.1.0...

WordPress Keep Backup Daily plugin <= 2.1.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Caesar Evan Santoso Patchstack Alliance in WordPress Plugin Keep Backup Daily versions = 2.1.0...

CVE-2025-23786

CVE-2025-23786 is a reflected XSS vulnerability in the WordPress plugin Email to Download (vulnerable up to 3.1.0). The issue is caused by improper neutralization of user input during web page generation, enabling an attacker to inject executable script via input that is reflected in the page. Pu...

SUSE CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...

WordPress Bit Assist plugin <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function vulnerability

Path Traversal to Authenticated Administrator+ Arbitrary File Read via downloadResponseFile Function vulnerability discovered by koffee in WordPress Plugin Bit Assist versions = 1.5.2...

PT-2025-6611 · WordPress · Bit Assist

Name of the Vulnerable Software and Affected Versions: Bit Assist plugin for WordPress versions up to, and including, 1.5.2 Description: The issue allows authenticated attackers with Administrator-level access and above to read the contents of arbitrary files on the server, which can contain...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2023-3489

The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS...

CVE-2025-24888

The CVE-2025-24888 issue affects the SecureDrop Client, specifically the API.download_reply() path traversal flaw. The vulnerability arises from using the filename in the Content-Disposition header to write the encrypted reply to disk; although server-side filenames are sanitized, the file can be...

CVE-2024-13543

The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-1058

CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded...

CVE-2025-1058

CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded...

CVE-2025-25243

SAP Supplier Relationship Management Master Data Management Catalog allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or...

PT-2025-6826

Name of the Vulnerable Software and Affected Versions ASCO 5310 Single-Channel Remote Annunciator versions all Description A Download of Code Without Integrity Check issue exists, which could render the device inoperable when malicious firmware is downloaded. Recommendations For all versions, at...

SimpleHelp Path Traversal Vulnerability

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords...

Schneider Electric ASCO 5310和ASCO 5350 安全漏洞

The Schneider Electric ASCO 5310 and Schneider Electric ASCO 5350 are both single-channel remote alarms from Schneider Electric France. A security vulnerability exists in the Schneider Electric ASCO 5310 and ASCO 5350 that stems from the inclusion of a code download vulnerability without integrit...

CVE-2025-26351

A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests...