66 matches found
CVE-2025-10307
Exploit: Arbitrary File Deletion via Backuply tarfile path traversal Browser Console PoC authenticated admin async = const page = $location.origin/wordpress/wp-admin/admin.php?page=backuply; // 1 Extract a valid nonce from the Backuply page const html = await fetchpage, credentials: 'same-origin'...
CVE-2026-93953
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
CVE-2026-93953 Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
CVE-2026-93953
The Backuply WordPress plugin (versions
EUVD-2026-102613
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
CVE-2026-93953: Improper Neutralization of Special Elements used in an SQL Command
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
WordPress Backuply plugin <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation vulnerability
Authenticated Subscriber+ Second-Order SQL Injection via Restore to Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Backuply – Backup, Restore, Migrate and Clone versions = 1.5.8...
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...
PT-2026-115369
Name of the Vulnerable Software and Affected Versions Backuply versions prior to 1.5.9 Description Backuply is subject to a second-order SQL Injection that allows authenticated users with subscriber-level access and above to escalate privileges and take full control of a site. The issue occurs wh...
CVE-2024-2294
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backupname parameter in the backuplydownloadbackup function. This makes it possible for attackers to have an account with only...
EUVD-2024-16625
Malicious code in bioql PyPI...
EUVD-2024-49339
Malicious code in bioql PyPI...
EUVD-2024-16487
Malicious code in bioql PyPI...
EUVD-2025-31222
Malicious code in bioql PyPI...
EUVD-2024-27249
Malicious code in bioql PyPI...
CVE-2025-10307
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with...
CVE-2025-10307 Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with...
CVE-2025-10307
CVE-2025-10307 – Backuply WordPress plugin . Affected: Backuply – Backup, Restore, Migrate and Clone (all versions up to 1.4.8). Root cause: insufficient validation of file paths in the delete backup feature, enabling an authenticated attacker with Administrator+ privileges to delete arbitrary se...
CVE-2025-10307 Backuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete backup functionality in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with...
WordPress Backuply plugin <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion vulnerability
Authenticated Admin+ Arbitrary File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Backuply – Backup, Restore, Migrate and Clone versions = 1.4.8...