CVE-2024-1962

The CM Download Manager WordPress plugin (versions prior to 2.9.1 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks in certain locations. This flaw could allow an attacker to trick a logged-in administrator into editing downloads. This vulnerability has be...

CVE-2024-1232

The CM Download Manager WordPress plugin, in versions prior to 2.9.0 , is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of sufficient CSRF checks in certain areas. This flaw could allow an attacker to trick a logged-in administrator into performing actions, specifically deleting d...

CVE-2024-1231

The CM Download Manager WordPress plugin, prior to version 2.9.0 , is vulnerable to Cross-Site Request Forgery (CSRF) due to missing CSRF checks in certain areas. This flaw could enable an attacker to trick a logged-in administrator into unpublished downloads via a CSRF attack. The vulnerability ...

CVE-2022-3076

CM Download Manager for WordPress (plugin before 2.8.6) allows high-privilege users (admin) to upload arbitrary files by adding extensions (e.g., PHP) in Settings, without proper validation. This can enable an authenticated admin to place malicious PHP files in the site uploads path, with PoC evi...

CVE-2014-9129

CM Download Manager (WordPress) before version 2.0.7 is affected by CVE-2014-9129: a CSRF vulnerability allows authenticated admins to be hijacked and stored XSS via the addons_title field on the CMDM_admin_settings page (POST to wp-admin/admin.php). Root cause: insufficient validation/CSRF prote...

CVE-2020-24146

CVE-2020-24146 affects the WordPress plugin CM Download Manager (cm-download-manager) up to version 2.7.0. A directory traversal vulnerability is triggered via the fileName parameter in the deletescreenshot action, allowing authorized users to delete arbitrary files and potentially cause a denial...

CVE-2020-27344

The CVE-2020-27344 entry corresponds to a Cross-Site Scripting (XSS) flaw in the WordPress plugin cm-download-manager, affected until version 2.8.0. The root cause is improper validation/sanitization of client-supplied data, specifically the uploaded filename in Content-Disposition, which can all...

CVE-2020-24145

CVE-2020-24145 affects the WordPress CM Download Manager (cm-download-manager) plugin, version 2.7.0, via an XSS vulnerability exploitable through a crafted deletescreenshot action. The issue is confirmed across multiple sources (NVD/Red Hat/CNVD, WPVulnDB). Impact is XSS with potential script/HT...