PT-2025-6081 · Unknown · Wandb/Openui

Name of the Vulnerable Software and Affected Versions: wandb/openui version c945bb859979659add5f490a874140ad17c56a5d Description: The issue concerns unauthenticated endpoints that allow file uploads and downloads from an AWS S3 bucket, potentially leading to denial of service, stored XSS, and...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...

CVE-2025-22978

eladmin =2.7 is vulnerable to CSV Injection in the exception log download module...

CVE-2025-20183

A vulnerability in a policy-based Cisco Application Visibility and Control AVC implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint. The vulnerability i...

CVE-2024-13529

The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialvsenddownloadfile' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers...

CVE-2024-55214

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality...

CVE-2025-25163 WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Zach Swetz Plugin A/B Image Optimizer allows Path Traversal. This issue affects Plugin A/B Image Optimizer: from n/a through 3.3...

CVE-2025-25163 WordPress Plugin A/B Image Optimizer Plugin <= 3.3 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows Path Traversal.This issue affects Plugin A/B Image Optimizer: from n/a through = 3.3...

dhtmlx FileExplorer 安全漏洞

dhtmlx FileExplorer is a JavaScript file system from dhtmlx, Inc. A security vulnerability exists in dhtmlx FileExplorer version v.8.4.6, which originated from a local file inclusion vulnerability that allows remote attackers to obtain sensitive information via the file download feature...

Cisco Secure Web Appliance Range Request Bypass (cisco-sa-swa-range-bypass-2BsEHYSu)

According to its self-reported version, Cisco Secure Web Appliance Range Request Bypass is affected by a vulnerability. - A vulnerability in a policy-based Cisco Application Visibility and Control AVC implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an...

CVE-2024-55214

Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality...

PT-2025-5985 · Unknown · Dhtmlxfileexplorer

Name of the Vulnerable Software and Affected Versions: dhtmlxFileExplorer version 8.4.6 Description: The issue allows a remote attacker to obtain sensitive information through the file download functionality. This is due to a local file inclusion vulnerability. Recommendations: For...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...

CVE-2021-4356

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfmfilemetaupdate AJAX action. This makes it possible...

CVE-2021-26608

An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash...

CVE-2021-26630

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function...

CVE-2021-26625

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation...

CVE-2025-23541

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in edmon.parker Download, Downloads ydn-download allows Reflected XSS.This issue affects Download, Downloads : from n/a through = 1.4.2...

CVE-2025-23882

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in misanthrop WP Download Codes wp-download-codes allows Reflected XSS.This issue affects WP Download Codes: from n/a through = 2.5.4...

CVE-2025-24663

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through = 3.9.25...