Threats Tagged 'cwe-552'

A vulnerability in the Paid Membership Subscriptions WordPress plugin before version 3.0.7 allows unauthenticated users to download exported member and payment data files. These files, containing personally identifiable information (PII), are written to a predictable location in the uploads directory without proper access protection. This exposure can occur while the export artifact is present on the server.

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.

CVE-2026-57990 is a high-severity vulnerability in Microsoft Edge (Chromium-based) where files or directories are accessible to external parties, potentially allowing unauthorized information disclosure over a network. The vulnerability has a CVSS score of 7.4 and has been officially fixed by Microsoft.

Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.