CM Download Manager vulnerabilities
We track 2 vulnerabilities in CM Download Manager products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 25, 2024.
2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score
Latest CM Download Manager vulnerabilities
- 8.8 High severity
CM Download Manager: Cross-Site Request Forgery
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
- 7.2 High severity
CM Download Manager: Unrestricted Upload of File with Dangerous Type
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.