GDidees CMS v3.9.1 and lower exists to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.
gdidees gdidees cms