Simple Download Monitor (Unknown) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2022-03-14. Vendor: Unknown.

CVEs of Simple Download Monitor

• CVE-2021-24692 - CVSS 6.5 (medium), 2022-03-14: The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as…
• CVE-2021-24696 - CVSS 8.8 (high), 2022-01-24: The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins…
• CVE-2021-24694 - CVSS 5.4 (medium), 2022-01-24: The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack…
• CVE-2021-24693 - CVSS 9 (critical), 2021-11-08: The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow…
• CVE-2021-24698 - CVSS 4.3 (medium), 2021-11-08: The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own,…
• CVE-2021-24697 - CVSS 6.1 (medium), 2021-11-08: The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date…
• CVE-2021-24695 - CVSS 7.5 (high), 2021-11-08: The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place…