Unknown CM Download Manager vulnerabilities
4 vulnerabilities
Known vulnerabilities in Unknown CM Download Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2022-3076cminds · cm_download_manager +2 moreCM Download Manager < 2.8.6 - Admin+ Arbitrary File UploadThe CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.EPSS1.56%HighCVE-2024-1962cminds · cm_download_manager +2 moreCM Download and File Manager < 2.9.1 - Download Edit via CSRFThe CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attackEPSS0.47%MediumCVE-2024-1231cminds · cm_download_manager +2 moreCM Download and File Manager < 2.9.0 - Download Unpublish via CSRFThe CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attackEPSS0.22%MediumCVE-2024-1232cminds · cm_download_manager +2 moreCM Download Manager < 2.9.0 - Download Deletion via CSRFThe CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attackEPSS0.24%