Read the docs

CreativeMindsSolutions

Records49All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9

Exploited now

CreativeMindsSolutions records in CISA KEV

No CreativeMindsSolutions vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cm Download Manager 8 records HIGH Cm Popup 3 records MEDIUM Cm Search And Replace 3 records MEDIUM Cm Answers 2 records LOW Cm Table Of Contents 2 records MEDIUM Tooltip Glossary 2 records LOW Cm Ad Changer 1 record LOW Cm E-mail Blacklist 1 record HIGH

Records

8 records in Cm Download Manager · all components

TI-2024-01828 CVE-2024-1962 · GHSA-6fc3-8g79-3f39

CM Download and File Manager < 2.9.1 - Download Edit via CSRF

Priority HIGH 71

The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0047 Published 2024-03-25 Fixed in 2.9.1 CWE-352
TI-2022-02838 CVE-2022-3076 · GHSA-9q5w-5rhq-cpgp

CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

Priority HIGH 65

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01556 Published 2022-09-26 Fixed in 2.8.6 CWE-434
TI-2024-01145 CVE-2024-1231 · GHSA-wvw8-hcw4-jwqp

CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF

Priority MEDIUM 63

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack

CVSS 3.1MEDIUM 6.8 Local Low privileges User interaction EPSS 0.00225 Published 2024-03-25 Fixed in 2.9.0 CWE-352
TI-2024-01146 CVE-2024-1232 · GHSA-37x3-hqf8-5w7p

CM Download Manager < 2.9.0 - Download Deletion via CSRF

Priority MEDIUM 55

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00244 Published 2024-03-25 Fixed in 2.9.0 CWE-352
TI-2020-14816 CVE-2020-24146 · GHSA-mjp7-fvxw-f332

Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for…

Priority LOW 39

Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01673 Published 2021-07-07 No fix listed CWE-22
TI-2014-07409 CVE-2014-9129 · GHSA-p437-qg7q-wh7p

Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager…

Priority LOW 33

Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01533 Published 2014-12-05 No fix listed CWE-352
TI-2020-14815 CVE-2020-24145 · GHSA-8w8j-8c2x-fmpj

Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka…

Priority LOW 29

Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot actio…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00996 Published 2021-07-07 No fix listed CWE-79
Open these records in search →