CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2222 – Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
https://notcve.org/view.php?id=CVE-2022-2222
27 Jun 2022 — The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup. El plugin Download Monitor de WordPress versiones anteriores a 4.5.91, no asegura que los archivos a descargar estén dentro de las carpetas del blog, y no sean confidenciales, permitiendo a usuarios con altos privilegios como e... • https://wpscan.com/vulnerability/dd48624a-1781-419c-a3c4-1e3eaf5e2c1b • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31567 – WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability
https://notcve.org/view.php?id=CVE-2021-31567
29 Oct 2021 — Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS. Se ha detectado una vulnerabilidad de Descarga de Archivos Arbitrarios Autenticada (admin+) en el plugin Download M... • https://github.com/WPChill/download-monitor/blob/master/changelog.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-552: Files or Directories Accessible to External Parties •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36920 – WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-36920
29 Oct 2021 — Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6). Se ha detectado una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejado y autenticado en el plugin Download Monitor de WordPress (versiones anteriores a 4.4.6 incluyéndola) • https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-reflected-cross-site-scripting-xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23174 – WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-23174
29 Oct 2021 — Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0]. Se ha detectado una vulnerabilidad de tipo Cross-Site Scripting (XSS) persistente y autenticada (admin+) en el plugin Download Monitor de WordPress (versiones anteriores a 4.4.6 incluyéndola) Parámetros vulnerables: &post_title, &downloadable_file_version[0] • https://patchstack.com/database/vulnerability/download-monitor/wordpress-download-monitor-plugin-4-4-6-authenticated-persistent-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 3CVE-2021-24786 – Download Monitor < 4.4.5 - Admin+ SQL Injection
https://notcve.org/view.php?id=CVE-2021-24786
20 Oct 2021 — The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue El plugin Download Monitor de WordPress versiones anteriores a 4.4.5, no comprueba ni escapa del parámetro GET "orderby" antes de usarlo en una sentencia SQL cuando son visualizados los registros, conllevando un problema de inyección SQL WordPress Download Monitor WordPress plugin versions prior to 4.4... • https://packetstorm.news/files/id/165809 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9296 – Download Monitor < 1.7.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9296
20 Apr 2015 — The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. El complemento download-monitor versiones anteriores a 1.7.1 para WordPress tiene XSS relacionado con add_query_arg • https://wordpress.org/plugins/download-monitor/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2013-5098 – Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter
https://notcve.org/view.php?id=CVE-2013-5098
23 Jul 2013 — Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262. Vulnerabilidad Cross-site scripting (XSS) en admin/admin.php en el plugin Download Monitor anterior a v3.3.6.2 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro “sort”, una vulnerabilidad diferente d... • http://plugins.trac.wordpress.org/changeset/723187/download-monitor • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 1CVE-2013-3262 – Download Monitor < 3.3.6.2 - Cross-Site Scripting via p Parameter
https://notcve.org/view.php?id=CVE-2013-3262
22 Jul 2013 — Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter. Vulnerabilidad Cross-site scripting (XSS) en admin/admin.php en el plugin Download Monitor anterior a v3.3.6.2 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro “p”. • http://plugins.trac.wordpress.org/changeset/723187/download-monitor • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2012-4768 – Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4768
06 Sep 2012 — Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. Vulnerabilidad de XSS en el plugin Download Monitor anterior a 3.3.5.9 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro dlsearch en la URI por defecto. • https://www.exploit-db.com/exploits/37787 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •