EUVD-2026-96615

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108676

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108676 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108676

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the SysAnnouncementController downLoadFiles handler. This vulnerability allows low-privileged authenticated users to bypass authorization checks by supplying a known announcement ID. An attack...

CVE-2026-108676

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108676 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

WordPress Plugin WP Content Source Control - Directory Traversal Detection

A directory traversal vulnerability in the filegetcontents function in downloadfiles/download.php in the WP Content Source Control wp-source-control plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the path parameter. !/usr/bin/env python3...

Simple E-Learning System security vulnerabilities

Simple E-Learning System is a simple e-learning system by Carlo Montero's personal developer. simple E-Learning System is vulnerable to an arbitrary file download vulnerability, which stems from a lack of validation of external input data in the downloadFiles.php parameter download. validation. A...

PT-2017-17634

Name of the Vulnerable Software and Affected Versions Unitrends Enterprise Backup versions prior to 9.1.2 Description The issue allows an authenticated user to execute arbitrary OS commands by sending a specially crafted filename to the "/api/restore/download-files" endpoint. This is related to t...

PT-2014-6434

Name of the Vulnerable Software and Affected Versions WP Content Source Control plugin versions 3.0.0 and earlier Description A directory traversal issue exists in the file get contents function within the downloadfiles/download.php file of the WP Content Source Control plugin. This allows remote...