Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure

Export WP Page to Static HTML & PDF WordPress plugin = 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger...

Nginx UI < 2.3.3 - Information Disclosure

Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. id: CVE-2026-27944 info: name: Nginx UI 2.3.3 ...

WordPress Backup Migration <= 1.3.6 - Path Traversal

WordPress Backup Migration plugin versions up to 1.3.6 contain a path traversal and file validation issue in handledownloading function, letting unauthenticated attackers download backup files containing sensitive information. id: CVE-2023-6266 info: name: WordPress Backup Migration = 1.3.6 - Pat...

phpMyFAQ - Configuration Backup Disclosure

phpMyFAQ = 4.0.16 contains an information disclosure vulnerability caused by unauthenticated access to configuration backup ZIP generation and download, letting remote attackers access sensitive configuration files, exploit requires no authentication. id: CVE-2025-69200 info: name: phpMyFAQ -...

JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing

JetBackup WordPress plugin = 2.0.9.9 does not use index files to prevent directory listing in certain configurations, letting malicious actors leak backup files, exploit requires access to the web server. id: CVE-2023-7165 info: name: JetBackup = 2.0.9.7 - Sensitive Information Exposure via...

WordPress BackWPup < 4.0.4 - Backup File Disclosure

BackWPup WordPress plugin 4.0.4 contains a directory listing vulnerability caused by lack of access restrictions in its temporary backup folder, letting unauthenticated attackers download site backups, exploit requires no authentication. id: CVE-2023-7164 info: name: WordPress BackWPup 4.0.4 -...

NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read

NAKIVO Backup & Replication is a data protection solution used for backing up and restoring virtualized and physical environments. A vulnerability has been identified in certain versions of NAKIVO Backup & Replication that allows an unauthenticated attacker to read arbitrary files on the underlyi...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

Discuz! X5.0 - Authentication Bypass

Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and loggingctl::loggingmore, letting unauthenticated remote attackers access database backup and restore functions, exploit requires...

WordPress DB Backup <=4.5 - Local File Inclusion

WordPress Plugin DB Backup 4.5 and possibly prior versions are prone to a local file inclusion vulnerability because they fail to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. id:...

WordPress WP Clone <= 2.4.2 - Database Backup Exposure

Clone WordPress plugin 2.4.3 contains a buffer overflow caused by storing in-progress backup information in publicly accessible buffer files at a static file path, letting attackers access sensitive backup data, exploit requires no special privileges id: CVE-2023-6750 info: name: WordPress WP Clo...

WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload

WordPress Backup Guard plugin before 1.6.0 is susceptible to authenticated arbitrary file upload. The plugin does not ensure that imported files are in SGBP format and extension, allowing high-privilege users to upload arbitrary files, including PHP, possibly leading to remote code execution. id:...

CVE-2026-55168

CVE-2026-55168 This repository contains a simple PoC for CVE-2026-55168 in Runtipi. The issue is an authenticated arbitrary file write that can be reached through the backup restore flow. A crafted backup archive can plant a symlink into restored application data, and a later normal config update...

chlonium

Chlonium Chlonium is an application designed for cloning Chromium Cookies. From Chromium 80 and upwards, cookies are encrypted using AES-256 GCM, with a state key which is stored in the Local State file. This state key is encrypted using DPAPI. This is a change from older versions, which used DPA...

CVE-2024-22274-RCE

权限提升：VMware vCenter Server 认证远程代码执行 📜 描述 “com.vmware.appliance.recovery.backup.job.create” 和 “com.vmware.appliance.recovery.backup.validate” API 组件存在标志注入漏洞，可被利用在目标系统上以 root 用户身份执行任意命令。 📚 目录 📜 描述 🛠️ 安装 ⚙️ 用法 🔎 发现 📝 注意事项 💁 参考资料 📢 免责声明 🛠️ 安装与配置 !NOTE 要使用此 PoC 漏洞利用，您必须拥有有效凭据，并通过 SSH 登录到 VMware vCenter...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core 备份-恢复 符号链接路径遍历 → RCE CVSS 8.4（严重） · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR 经过身份验证的（管理员）攻击者上传精心构造的备份 tar 包。恢复路径使用 filter="fullytrusted" 解压内部的 homeassistant.tar.gz，并且只校验成员的 名称 — 从不校验 SYMTYPE 的 链接名 。指向绝对路径（例如 Python 的 site-packages/）的符号链接会被保留，因此随后写入的...

iPhoneRestrictionsPasscodeBF

iPhoneRestrictionsPasscodeBF iPhoneRestrictionsPasscodeBF 工具会在 Windows 机器中搜索任意 iOS 版本的 iPhone 备份，如果存在，该工具会在备份中搜索限制密码。限制密码是一个 4 位数字密码，用于 iPhone 设备上保护/限制对某些功能和应用的访问。如果启用了此功能，密码会以加密形式存储在手机备份中。我们提供的工具能够定位该密码并对其进行解密。...

CVE-2024-56067

CVE-2024-56067 WP SuperBackup = 2.3.3 - 缺少授权检查导致未认证备份文件下载 描述 WordPress 插件 Super Backup & Clone - Migrate for WordPress 在 2.3.3 及之前的所有版本中，由于某个函数缺少权限检查，存在未授权访问漏洞。这使得未认证的攻击者能够下载完整的备份。 详情 类型 : 插件 Slug : indeed-wp-superbackup 受影响版本 : 2.3.3 CVSS 分数 : 7.5 CVSS 评级 : 高 CVSS 向量 :...

ohmybackup

ohmybackup ohmybackup - Scan Victim's Backup Directories & Backup Files ohmybackup Scans backup folders on target sites. Searches archived files in the folders it finds. With the 2-file scanning system, it adds extensions and filenames in different ways, making it more likely to be found. 1 -...