Wpchill

Download Monitor

20 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.2

CVE-2024-30501

  • EPSS 0.61%
  • Veröffentlicht 29.03.2024 14:15:14
  • Zuletzt bearbeitet 28.04.2026 19:24:06

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.

7.5

CVE-2022-45354

  • EPSS 38.08%
  • Veröffentlicht 08.01.2024 21:15:08
  • Zuletzt bearbeitet 28.04.2026 19:18:58

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.

8.8

CVE-2023-34007

  • EPSS 0.72%
  • Veröffentlicht 20.12.2023 19:15:09
  • Zuletzt bearbeitet 28.04.2026 19:20:39

Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.

4.9

CVE-2023-31219

  • EPSS 0.63%
  • Veröffentlicht 13.11.2023 03:15:08
  • Zuletzt bearbeitet 28.04.2026 19:20:21

Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.

4.9

CVE-2022-2981

Exploit
  • EPSS 0.86%
  • Veröffentlicht 10.10.2022 21:15:10
  • Zuletzt bearbeitet 21.11.2024 07:02:01

The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an harden...

4.9

CVE-2022-2222

Exploit
  • EPSS 0.93%
  • Veröffentlicht 17.07.2022 11:15:09
  • Zuletzt bearbeitet 21.11.2024 07:00:34

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an harden...

6.8

CVE-2021-31567

  • EPSS 1.39%
  • Veröffentlicht 28.01.2022 20:15:11
  • Zuletzt bearbeitet 20.02.2025 21:15:12

Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via t...

4.8

CVE-2021-23174

  • EPSS 83.22%
  • Veröffentlicht 28.01.2022 20:15:10
  • Zuletzt bearbeitet 21.11.2024 05:51:19

Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].

5.4

CVE-2021-36920

  • EPSS 0.57%
  • Veröffentlicht 14.01.2022 20:15:10
  • Zuletzt bearbeitet 21.11.2024 06:14:18

Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).

7.2

CVE-2021-24786

Exploit
  • EPSS 17.48%
  • Veröffentlicht 03.01.2022 13:15:08
  • Zuletzt bearbeitet 22.05.2025 19:15:23

The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue