Vulnerabilities

Search by TI id or any alias (CVE, GHSA), vendor, product or CWE.

Filters

Reset all

Threatist priority CRITICAL 0 HIGH 0 MEDIUM 0 LOW 2

Signals Exploited in the wild (KEV) 0 Patch available 2 No fix listed 0 Has CVE 2

Fix status Fixed 2 Partial 0 Will not fix 0 Deferred 0 No fix listed 0

Impact type Code execution 0 Privilege escalation 0 Security bypass 2 Information disclosure 0 Tampering 0 Denial of service 0 Spoofing 0 Cross-site scripting 0 SQL injection 0

Attack vector Network 2 Adjacent network 0 Local 0 Physical 0

Requirements No authentication 1 No user interaction 2

Product

Products as named in CPE, with their records.

Published Last 7 days Last 30 days Last 12 months Any time

Weakness (CWE) CWE-284 Improper Access Control 1 CWE-425 Direct Request 1

1 selected

2 records

Sort

Release: Simple Download Monitor 3.9.6 × Clear all filters

TI-2021-06980 CVE-2021-24698 · GHSA-j66f-pwrh-8rh3

Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal

Priority LOW 21

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.

CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00675 · Published 2021-11-08 · Fixed in 3.9.6 CWE-284

TI-2021-06977 CVE-2021-24695 · GHSA-vh6h-77mp-jg82

Simple Download Monitor < 3.9.6 - Unauthenticated Log Access

Priority LOW 36

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the log…

CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01679 · Published 2021-11-08 · Fixed in 3.9.6 CWE-425

THREATIST.IO

Vulnerability intelligence for security teams and AI agents.

Vulnerabilities Vendors Exploited (KEV) API & MCP Newsletter Privacy policy Terms of use

Newsletter Vulnerability intelligence in your inbox Subscribe

© 2026 Threatist.io · X (@threatist)Data: CVE Program, NVD, CISA KEV, FIRST EPSS, GitHub Advisory Database and Red Hat security data (both CC BY 4.0), Microsoft Security Response Center. This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences

We would like to use Google Analytics cookies to see how the site is used. They are set only if you accept. Privacy policy