14 matches found
CVE-2026-82841: Exposure of Sensitive Information to an Unauthorized Actor
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...
CVE-2026-72737 Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups
Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that...
CVE-2018-20865
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...
CVE-2023-5775
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with...
Default credentials
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with...
CVE-2023-5775 BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with...
CVE-2023-5775 BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with...
CVE-2018-20865
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...
CVE-2018-20865
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...
Design/Logic Flaw
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...
CVE-2018-20865
CVE-2018-20865 affects cPanel prior to 76.0.8, where a Self XSS flaw exists in the WHM Addtional Backup Destination field (SEC-459). Exploitation context is not detailed in the provided documents, but the vulnerability is tied to user-supplied content in the WHM backup destination setting, enabli...
CVE-2018-20865
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...
PT-2019-10293
Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 76.0.8 Description: The issue concerns a Self XSS in the WHM Additional Backup Destination field. Recommendations: For versions prior to 76.0.8, update to version 76.0.8 or later to resolve the issue...