Login Request a demo
CD
Product
CM Download Manager
by Cminds · last CVE Mar 25, 2024
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 0High 3Medium 4Low 0
Severity
All severities8Critical0High3Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add CM Download Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-1962
8.8
0%
Mar 25
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF…
Affected: before 2.9.1
CVE-2020-24146
8.1
2%
Jul 7
Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial…
Affected: 2.7.0
CVE-2022-3076
7.2
2%
Sep 26
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting,…
Affected: before 2.8.6
CVE-2024-1231
6.8
0%
Mar 25
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a…
Affected: before 2.9.0
CVE-2020-24145
6.1
1%
Jul 7
Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or…
Affected: 2.7.0
CVE-2020-27344
6.1
1%
Oct 21
The cm-download-manager plugin before 2.8.0 for WordPress allows XSS
Affected: before 2.8.0
CVE-2024-1232
4.8
0%
Mar 25
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF…
Affected: before 2.9.0
CVE-2014-9129
–
2%
Dec 5
Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of…
Affected: through 2.0.6
Showing 8