CVE-2024-1962

The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack

CVE-2024-1231

The CM Download Manager WordPress plugin, in versions prior to 2.9.0 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of proper CSRF checks in certain areas. An attacker could leverage this flaw to force authenticated administrators to unpublish downloads without their ...

CVE-2024-1232

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack

CVE-2022-3076

CM Download Manager for WordPress (plugin before 2.8.6) allows high-privilege users (admin) to upload arbitrary files by adding extensions (e.g., PHP) in Settings, without proper validation. This can enable an authenticated admin to place malicious PHP files in the site uploads path, with PoC evi...

CVE-2014-9129

CM Download Manager (WordPress) before version 2.0.7 is affected by CVE-2014-9129: a CSRF vulnerability allows authenticated admins to be hijacked and stored XSS via the addons_title field on the CMDM_admin_settings page (POST to wp-admin/admin.php). Root cause: insufficient validation/CSRF prote...

CVE-2020-24146

CVE-2020-24146 affects the WordPress plugin CM Download Manager (cm-download-manager) up to version 2.7.0. A directory traversal vulnerability is triggered via the fileName parameter in the deletescreenshot action, allowing authorized users to delete arbitrary files and potentially cause a denial...

CVE-2020-27344

The CVE-2020-27344 entry corresponds to a Cross-Site Scripting (XSS) flaw in the WordPress plugin cm-download-manager, affected until version 2.8.0. The root cause is improper validation/sanitization of client-supplied data, specifically the uploaded filename in Content-Disposition, which can all...

CVE-2020-24145

CVE-2020-24145 affects the WordPress CM Download Manager (cm-download-manager) plugin, version 2.7.0, via an XSS vulnerability exploitable through a crafted deletescreenshot action. The issue is confirmed across multiple sources (NVD/Red Hat/CNVD, WPVulnDB). Impact is XSS with potential script/HT...