140 matches found
WordPress Backup Migration <= 1.3.6 - Path Traversal
WordPress Backup Migration plugin versions up to 1.3.6 contain a path traversal and file validation issue in handledownloading function, letting unauthenticated attackers download backup files containing sensitive information. id: CVE-2023-6266 info: name: WordPress Backup Migration = 1.3.6 - Pat...
CVE-2026-27944
CVE-2026-27944 - Nginx UI 未授权备份下载与解密 https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red 本工具是 CVE-2026-27944 的概念验证（PoC）漏洞利用程序。CVE-2026-27944 是 Nginx UI ≤ 2.3.2 中的一个严重漏洞，允许任何未经身份验证的攻击者通过 /api/backup...
CVE-2026-27944
CVE-2026-27944 POC：Nginx UI 未授权备份下载与仪表盘访问 本仓库包含针对 CVE-2026-27944 的增强型概念验证（POC）漏洞利用代码，该漏洞是 Nginx UI 中的一个严重漏洞。 该漏洞允许未授权攻击者通过 /api/backup 端点下载系统备份。此外，应用程序会在 X-Backup-Security HTTP 响应头中泄露 AES-256 加密密钥和 IV，使攻击者能够轻松解密下载的备份。 该增强型 POC 自动化了完整的攻击链：下载备份、解密其内容、提取配置机密（如 Node Secret 和 JWT...
CVE-2026-19454
JetBackup WordPress plugin versions 3.1.18.8 through 3.1.23.3 fail to perform the multisite authorization check before serving backup archives and job logs. This allows a non-Super Admin administrator of the network's main site to download a full backup of the entire multisite network, including ...
CVE-2026-19454 JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data...
CVE-2026-75045
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...
CVE-2026-55439
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint GET...
CVE-2026-55439 Halo: Path Traversal in Backup Download Leads to Arbitrary File Read
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint GET...
CVE-2026-55439 Halo: Path Traversal in Backup Download Leads to Arbitrary File Read
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint GET...
EUVD-2026-39465
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint GET...
CVE-2026-55439
Halo: Path traversal vulnerability (CVE-2026-55439) in the backup download endpoint allows authenticated administrators to read arbitrary files from the server when upgrading before 2.24.3. The issue arises because the backup filename in GET /apis/console.api.migration.halo.run/v1alpha1/backups/{...
CVE-2018-25437 WordPress CherryFramework Themes 3.1.4 Backup File Download
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the downloadbackup.php endpoint. Attackers can directly access the downloadbackup.php script in the admin/datamanagement...
CVE-2026-42951
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes...
CVE-2026-5753 All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmveSchedulesController::save' handler for 'adminpostai1wmscheduleeventsave' not verifying user capabilities before saving...
CVE-2026-5753 All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmveSchedulesController::save' handler for 'adminpostai1wmscheduleeventsave' not verifying user capabilities before saving...
VulnCheck KEV: CVE-2022-0633
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site such as subscriber to download the most recent site & database...
Exploit for Missing Encryption of Sensitive Data in Nginxui Nginx_Ui
CVE-2026-27944 POC: Nginx UI Unauthenticated Backup Download +...
Exploit for CVE-2026-27944
CVE-2026-27944 - Nginx-UI Unauthenticated Backup Download !...
Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure
Summary The /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data user credentials,...
CVE-2026-27944
CVE-2026-27944 affects Nginx UI prior to 2.3.3, where the /api/backup endpoint is accessible without authentication. The response header X-Backup-Security leaks the AES decryption key/IV, enabling an unauthenticated attacker to download a full system backup (including credentials, tokens, SSL key...