17 matches found
CVE-2026-15019
Direct Download for WooCommerce (WordPress plugin) is vulnerable to directory traversal via the file_id path segment in the top-level include function, affecting all versions up to and including 1.19 . The root cause is that the product ownership check only verifies that some free, virtual, downl...
CVE-2026-82835 caoqianming django-vue-admin file access control
A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument fileid can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the...
CVE-2026-5337
During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference IDOR attack. This vulnerability exists because the Frontend File Manager Plugin WordPress plugin through 23.6 does not properly valida...
EUVD-2026-26818
During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference IDOR attack. This vulnerability exists because the Frontend File Manager Plugin WordPress plugin through 23.6 does not properly valida...
WordPress plugin Frontend File Manager Plugin 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is a...
The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.
The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the fileid parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
CVE-2026-1280 Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfmsendfileinemail' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files v...
CVE-2026-1280 Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfmsendfileinemail' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files v...
EUVD-2005-3501
Malware in sbrugna...
EUVD-2005-4422
Malware in sbrugna...
CVE-2024-25513
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the fileid parameter at /CorporateCulture/kaizendownload.aspx...
CVE-2024-25523
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the fileid parameter at /filemanage/filememo.aspx...
CVE-2024-25523
The office automation system RuvarOA versions v6.01 and v12.01 is vulnerable to a SQL injection flaw. The root cause is a lack of validation for the file_id parameter within the /filemanage/file_memo.aspx endpoint against external SQL input. An attacker can exploit this to execute unauthorized SQ...
CVE-2024-25523
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the fileid parameter at /filemanage/filememo.aspx...
CVE-2024-25513
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the fileid parameter at /CorporateCulture/kaizendownload.aspx...