CVE-2023-7201

The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2023-7201

The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2023-7201 Everest Backup < 2.2.5 - Admin+ Arbitrary File Upload

The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

WBSAirback 安全漏洞

WBSAirback is a next generation storage and backup system from WBSAirback. A code execution vulnerability exists in WBSAirback version 21.02.04, which can be exploited by an attacker to execute arbitrary code...

PT-2024-27865 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue is a stored Cross-Site Scripting XSS vulnerability that occurs through the "/admin/BackupSchedule" endpoint, specifically in the description field. This could allow a remote user to send a...

PT-2024-27854 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue is a stored Cross-Site Scripting XSS vulnerability that occurs through the /admin/BackupTemplate endpoint, specifically in the name and description fields. This could allow a remote user to...

WordPress Plugin Everest Backup 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress WPvivid Backup and Migration Plugin <= 0.9.99 is vulnerable to PHP Object Injection

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.99 Fixed in 0.9.100 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-3054 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 2efae3e5e650 Credits Maksim Kosenko Required...

WordPress Everest Backup Plugin < 2.2.5 is vulnerable to Arbitrary File Upload

Software Everest Backup Type Plugin Vulnerable versions 2.2.5 Fixed in 2.2.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-7201 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID e4434e41add7 Credits Emad Required privilege Administrator Publish...

CVE-2023-7201: Undefined Security Weakness

The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2024-3783: Improper Limitation of a Pathname to a Restricted Directory

The Backup Agents section in WBSAirback 21.02.04 is affected by a Path Traversal vulnerability, allowing a user with low privileges to download files from the system...

PT-2024-27772

Name of the Vulnerable Software and Affected Versions WBSAirback version 21.02.04 Description The issue allows a user with low privileges to download files from the system due to a Path Traversal vulnerability in the Backup Agents section. Recommendations For WBSAirback version 21.02.04, consider...

PT-2024-15226 · WordPress · Everest Backup

Name of the Vulnerable Software and Affected Versions: The Everest Backup WordPress plugin versions prior to 2.2.5 Description: The issue allows high privilege users, such as admins, to upload arbitrary files on the server, even when they should not be allowed to, for example in a multisite setup...

PT-2024-19666 · WordPress · Wp Staging Pro +1

Name of the Vulnerable Software and Affected Versions: WP STAGING WordPress Backup Plugin versions prior to 3.4.0 wp-staging-pro WordPress plugin versions prior to 5.4.0 Description: The issue concerns the lack of sanitization and escaping of certain settings in the WP STAGING WordPress Backup...

CVE-2024-3706

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d Espeto. This vulnerability allows an attacker to view a php backup file controlaccess.php-LAST where database credentials are stored...

CVE-2024-3706

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d Espeto. This vulnerability allows an attacker to view a php backup file controlaccess.php-LAST where database credentials are stored...

CVE-2024-3054

WPvivid Backup & Migration Plugin for WordPress (≤ version 0.9.99) is affected by a PHAR Deserialization vulnerability due to insufficient validation of tree_node[id] in wpvividstg_get_custom_exclude_path_free. The issue allows an authenticated attacker with admin-level access to cause PHAR-based...

OpenGnsys 信息泄露漏洞

OpenGnsys is an open source computing device management software from the Spanish OpenGnsys project. An information disclosure vulnerability exists in OpenGnsys version 1.1.1d Espeto, which stems from the presence of an information exposure vulnerability that allows an attacker to view a php back...

PT-2024-24093 · Unknown · Stable-Diffusion-Webui

Name of the Vulnerable Software and Affected Versions: stable-diffusion-webui version 1.7.0 Description: The issue is related to a limited file write affecting Windows systems. It occurs in the create ui method Backup/Restore tab in modules/ui extensions.py, where user input is taken into the...

PT-2024-23469 · WordPress · Wpvivid Backup & Migration Plugin

Name of the Vulnerable Software and Affected Versions: WPvivid Backup & Migration Plugin for WordPress versions up to, and including, 0.9.99 Description: The issue arises from insufficient path validation on the tree nodenodeid parameter, allowing authenticated attackers with admin-level access a...