Advisories · Technology
codename065 Download Manager.
Every CVE that names codename065 Download Manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
- codename065 Download Manager
- Information disclosure
- CVSS 6.4 Medium
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
- codename065 Download Manager
- Broken access control
- CVSS 6.4 Medium
Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
- codename065 Download Manager
- Broken access control
- CVSS 6.4 Medium
Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter
- codename065 Download Manager
- Information disclosure
- CVSS 6.1 Medium
Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 7.3 High
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword
- codename065 Download Manager
- CWE-353
- CVSS 4.3 Medium
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
- codename065 Download Manager
- Broken access control
- CVSS 5.3 Medium
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
- codename065 Download Manager
- Hard-coded credentials
- CVSS 6.1 Medium
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 8.8 High
Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion
- codename065 Download Manager
- Path traversal
- CVSS 5.4 Medium
Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite
- codename065 Download Manager
- Path traversal
- CVSS 5.3 Medium
Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files
- codename065 Download Manager
- Broken access control
- CVSS 7.3 High
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
- codename065 Download Manager
- Code injection
- CVSS 6.4 Medium
Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 7.5 High
Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary
- codename065 Download Manager
- CWE-289
- CVSS 4.4 Medium
Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Download Manager <= 3.2.84 - Missing Authorization
- codename065 Download Manager
- Broken access control
- CVSS 6.4 Medium
Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 8.8 High
Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization
- codename065 Download Manager
- Insecure deserialization
- CVSS 6.4 Medium
Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Download Manager <= 3.2.42 - Reflected Cross-Site Scripting
- codename065 Download Manager
- Cross-site scripting (XSS)