0.001 Low
EPSS
Percentile
32.7%
User agent strings are logged when requesting downloads that are processed by dwnldr and displayed back to the admin with no encoding, allowing for scripts to be stored and executed.
curl -A "User-Agent: " -O http:///?attachment_id=
rastating.github.io/dwnldr-1-0-stored-xss-disclosure