CVE-2025-2048

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Unknown	Lana Downloads Manager	< 1.10.0

References

https://wpscan.com/vulnerability/05c664e8-110e-4a31-8377-41a0422508a7/Exploit, Third Party Advisory

Timeline

Published: Apr 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-20493.5A vulnerability classified as problematic has been found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file CVE-2025-20509.8A vulnerability classified as critical was found in PHPGurukul User Registration & Login and User Management System 3.3. Affected by this vu CVE-2025-20518.8A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This vulnerability affects CVE-2025-20528.8A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This issue affects some unknown CVE-2025-20538.8A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as critical. Affected is an unknown CVE-2025-20547.2A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerabilit CVE-2025-20556.8The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which cou CVE-2025-20567.5The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and includ CVE-2025-20579.8A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown fun CVE-2025-20589.8A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this vulnerabilit CVE-2025-20599.8A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this issue is some unk CVE-2025-20609.8A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as critical. This affects an unknown p