CVE-2022-0828

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published: Apr 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08298.1Improper Authorization in GitHub repository webmin/webmin prior to 1.990.CVE-2022-08306.5The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not san CVE-2022-08315.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2022-08325.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2022-08334.3The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allo CVE-2022-08345.4The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter fo CVE-2022-08355.5AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.CVE-2022-08369.8The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an A CVE-2022-08375.4The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send CVE-2022-08386.1Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.CVE-2022-08399.8Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.CVE-2022-08404.8The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing hi