An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input.

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system.