CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9348 – Sell Downloads <= 1.0.7 - Improper Input Validation
https://notcve.org/view.php?id=CVE-2015-9348
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. El plugin sell-downloads versiones anteriores a 1.0.8 para WordPress, tiene restricciones insuficientes para adivinar mediante fuerza bruta los IDs de compra. • https://wordpress.org/plugins/sell-downloads/#developers • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9511 – Sell Downloads <= 1.0.1 - Arbitrary File Read
https://notcve.org/view.php?id=CVE-2014-9511
The Sell Downloads plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.0.1 via the 'file' parameter. This can allow unauthenticated attackers to extract sensitive data such as settings/configuration files along with other useful information that can be used in future attacks. • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •