CVE-2024-1962

CVE-2024-1962 affects the CM Download Manager plugin for WordPress. The Red Hat entry and the initial description confirm that prior to version 2.9.1, the plugin lacks CSRF checks in certain areas, enabling a CSRF attack to cause logged-in admins to edit downloads. The description does not provid...

CVE-2024-1231

CVE-2024-1231 affects the CM Download Manager – WordPress plugin. The vulnerability arises because the plugin (pre-2.9.0) lacks CSRF protection in certain flows, enabling an attacker with a logged-in admin session to unpublish downloads via a CSRF request. Impact is authorisation-controlled (admi...

CVE-2024-1232

CM Download Manager (WordPress) is affected by CVE-2024-1232 due to missing CSRF protections in multiple areas, enabling CSRF-based actions that could allow an attacker to prompt a logged-in administrator to delete downloads. Root cause: CSRF checks not implemented consistently in the plugin prio...

CVE-2022-3076

CM Download Manager for WordPress (plugin before 2.8.6) allows high-privilege users (admin) to upload arbitrary files by adding extensions (e.g., PHP) in Settings, without proper validation. This can enable an authenticated admin to place malicious PHP files in the site uploads path, with PoC evi...

CVE-2014-9129

CM Download Manager (WordPress) before version 2.0.7 is affected by CVE-2014-9129: a CSRF vulnerability allows authenticated admins to be hijacked and stored XSS via the addons_title field on the CMDM_admin_settings page (POST to wp-admin/admin.php). Root cause: insufficient validation/CSRF prote...

CVE-2020-27344

The CVE-2020-27344 entry corresponds to a Cross-Site Scripting (XSS) flaw in the WordPress plugin cm-download-manager, affected until version 2.8.0. The root cause is improper validation/sanitization of client-supplied data, specifically the uploaded filename in Content-Disposition, which can all...

CVE-2020-24146

CVE-2020-24146 affects the WordPress plugin CM Download Manager (cm-download-manager) up to version 2.7.0. A directory traversal vulnerability is triggered via the fileName parameter in the deletescreenshot action, allowing authorized users to delete arbitrary files and potentially cause a denial...

CVE-2020-24145

CVE-2020-24145 affects the WordPress CM Download Manager (cm-download-manager) plugin, version 2.7.0, via an XSS vulnerability exploitable through a crafted deletescreenshot action. The issue is confirmed across multiple sources (NVD/Red Hat/CNVD, WPVulnDB). Impact is XSS with potential script/HT...