CVE-2026-39931: Unrestricted Upload of File with Dangerous Type

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

PT-2026-43060

Name of the Vulnerable Software and Affected Versions userSpice version 4.3.24 Description Cross-site scripting allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. By sending crafted requests to the 'backup.php' endpoint containing XSS payloads in the...

CVE-2018-25349: Improper Neutralization of Input During Web Page Generation

userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. Attackers can send crafted requests to the backup.php endpoint with XSS payloads in the X-Forwarded-For header that execute when administrators...

CVE-2026-6663: Missing Authorization

The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints gwd-backup.php and gwd-logs.php not verifying authentication when the API key has not been...

PT-2026-8240

OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag backup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDrive GDriveEmail, GDrive GDriveFolderID, GDrive GDriveBackupCount, Nextcloud url, Nextcloud user, Nextcloud...

PT-2025-48101

Name of the Vulnerable Software and Affected Versions Deciso OPNsense affected versions not specified Description A flaw exists in Deciso OPNsense related to the handling of backup configuration files, specifically within the diag backup.php script. This allows network-adjacent attackers with...

EUVD-2008-0206

Malware in sbrugna...

EUVD-2024-46637

Malicious code in bioql PyPI...

CVE-2025-3729

A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file backup.php of the component Database Backup Handler. The manipulation of the argument txtdbname leads to os...

PT-2025-16901

Name of the Vulnerable Software and Affected Versions SourceCodester Web-based Pharmacy Product Management System version 1.0 Description A critical issue has been found in the Database Backup Handler component, specifically in the file backup.php. The manipulation of the txtdbname argument leads...

CVE-2025-3729: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file backup.php of the component Database Backup Handler. The manipulation of the argument txtdbname leads to os...

PT-2025-10457

Name of the Vulnerable Software and Affected Versions: DigitalDruid HotelDruid version 3.0.7 Description: The issue allows an attacker to execute arbitrary code and obtain sensitive information. This is achieved via the ripristina backup parameter in the "crea backup.php" endpoint. Recommendation...

CVE-2024-13911: Exposure of Sensitive Information to an Unauthorized Actor

The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35 via the /dashboard/backup.php file. This makes it possible for authenticated attackers, with Administrator-level acces...

PT-2025-9163

Name of the Vulnerable Software and Affected Versions Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress versions up to and including 2.35 Description The issue allows authenticated attackers with Administrator-level access and above to extract sensitive data,...

CVE-2024-13609: Exposure of Sensitive Information to an Unauthorized Actor

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...

CVE-2024-5415

A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to...

CVE-2024-5415

A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to...

CVE-2024-5415: Improper Neutralization of Input During Web Page Generation

A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to...

PhpMyBackupPro has cross-site scripting vulnerabilities

PhpMyBackupPro is a very easy to use, free web-based MySQL backup application from the Chris Younger project. A cross-site scripting vulnerability exists in PhpMyBackupPro version 2.3, which stems from a cross-site scripting vulnerability in the comments, db parameter in /phpmybackuppro/backup.ph...

CVE-2023-27180: Files or Directories Accessible to External Parties

GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /admin/backup.php...