Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: CreativeMindsSolutions Component: Cm Download Manager Clear all filters
TI-2024-01828 CVE-2024-1962 · GHSA-6fc3-8g79-3f39

CM Download and File Manager < 2.9.1 - Download Edit via CSRF

Priority HIGH 71

The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0047 Published 2024-03-25 Fixed in 2.9.1 CWE-352
TI-2024-01146 CVE-2024-1232 · GHSA-37x3-hqf8-5w7p

CM Download Manager < 2.9.0 - Download Deletion via CSRF

Priority MEDIUM 55

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00244 Published 2024-03-25 Fixed in 2.9.0 CWE-352
TI-2024-01145 CVE-2024-1231 · GHSA-wvw8-hcw4-jwqp

CM Download and File Manager < 2.9.0 - Download Unpublish via CSRF

Priority MEDIUM 63

The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack

CVSS 3.1MEDIUM 6.8 Local Low privileges User interaction EPSS 0.00225 Published 2024-03-25 Fixed in 2.9.0 CWE-352
TI-2022-02838 CVE-2022-3076 · GHSA-9q5w-5rhq-cpgp

CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload

Priority HIGH 65

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01556 Published 2022-09-26 Fixed in 2.8.6 CWE-434
TI-2020-14816 CVE-2020-24146 · GHSA-mjp7-fvxw-f332

Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for…

Priority LOW 39

Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01673 Published 2021-07-07 No fix listed CWE-22
TI-2020-14815 CVE-2020-24145 · GHSA-8w8j-8c2x-fmpj

Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka…

Priority LOW 29

Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot actio…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00996 Published 2021-07-07 No fix listed CWE-79
TI-2014-07409 CVE-2014-9129 · GHSA-p437-qg7q-wh7p

Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager…

Priority LOW 33

Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01533 Published 2014-12-05 No fix listed CWE-352