CVE-2024-13126

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-552

Affected software

VendorProductVersions
UnknownDownload Manager< 3.3.07

References

Timeline

Published
Mar 16, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-131274.8The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-131284.8The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-131298.8A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_seCVE-2024-13136.5It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing CVE-2024-131304.3A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as probleCVE-2024-131325.4A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3. This vulnerability affects unknown code of the file /admin/artCVE-2024-131338.8A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/CVE-2024-131348.8A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher CVE-2024-131355.4A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality CVE-2024-131369.8A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager CVE-2024-131375.4A vulnerability was found in wangl1989 mysiteforme 1.0. It has been classified as problematic. This affects the function RestResponse of theCVE-2024-131388.8A vulnerability was found in wangl1989 mysiteforme 1.0. It has been declared as critical. This vulnerability affects the function upload of
CVE-2024-13126: Medium severity, CVSS 4.6 | Vulnix