192 matches found
CVE-2020-21997
Smartwares HOME easy =1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control...
CVE-2019-11200
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. Malicious binaries can be...
CVE-2012-6099
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration...
CVE-2017-18410
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server SEC-284...
CVE-2025-1308 PX Backup Improper Sanitization Vulnerability
A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions...
Unauthorized Backup Access
yeswiki/yeswiki is vulnerable to unauthorized backup access. The vulnerability is due to missing authentication checks and predictable backup filenames, which allows an attacker to create and download backup archives without authentication...
PT-2025-18716 · Msp360 · Msp360 Backup
Name of the Vulnerable Software and Affected Versions: MSP360 Backup version 4.3.1.115 Description: An insecure file system permissions vulnerability in MSP360 Backup allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Recommendations: Upgrade to...
CVE-2025-32246
CVE-2025-32246 concerns a Missing Authorization vulnerability in the WordPress plugin “1-Click Backup & Restore Database” by Tim Nguyen. Affected range is from none specified to 1.0.3. The CVE entry provides a CVSS v3.1 base score of 5.4 (NETWORK, LOW-PRIVILEGES, NONE UI, LOW confidentiality/inte...
CVE-2025-30224
MyDumper is a MySQL Logical Backup Tool. The MySQL C client library libmysqlclient allows authenticated remote actors to read arbitrary files from client systems via a crafted server response to LOAD LOCAL INFILE query, leading to sensitive information disclosure when clients connect to untrusted...
CVE-2025-24221
This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, visionOS 2.4. Sensitive keychain data may be accessible from an iOS backup...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-1316link is external Edimax IC-7100 IP Camera OS Command Injection Vulnerability CVE-2024-48248link is external NAKIVO Backup and Replication Absolute Path...
CVE-2024-48248
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials...
CVE-2025-26887
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through = 5.21.35...
1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php
Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive...
CVE-2020-35948
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xclonerrestore.php writefileaction could...
CVE-2024-32876
NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could have resulted in...
CVE-2024-12330
CVE-2024-12330 applies to WP Database Backup – Unlimited Database & Files Backup by Backup for WP (WordPress). The vulnerability enables Sensitive Information Exposure via publicly accessible backup files in all versions up to 7.3, allowing unauthenticated attackers to extract database data. Root...
CVE-2024-56273
CVE-2024-56273 describes a missing authorization flaw in the WPvivid Backup & Migration plugin (affected: WPvivid Backup & Migration
CVE-2024-12850 Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read
The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the databasebackupajaxdownload function. This makes it possible for authenticated attackers, with administrator-level access...