Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,567 results · page 8 of 32
Aug 13, 2025Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature.CVE-2012-10059 · Other software · Dolibarr Project · reported by VulnCheckCritical 9.4
Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.
- Product
- ERP/CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comseclists.org
Aug 11, 2025Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logsCVE-2025-8864 · Other software · YugabyteDB Inc · reported by security@yugabyte.comMedium 6.8
Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs
- Product
- YugabyteDB Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file anCVE-2025-53395 · Other software · reported by MITREHigh 7.7
Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with administrative privileges mounts a backup by opening the .mrimgx file, Reflect loads the attacker's VSSSvr.dll after the mount completes. This occurs because of untrusted DLL search path behavior in ReflectMonitor.exe.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmacrium.commacrium.com
Aug 4, 2025Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup filCVE-2025-53394 · Other software · reported by MITREHigh 7.7
Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with administrative privileges opens the crafted backup file and proceeds to mount it, Reflect launches the renamed executable (e.g., explorer.exe), which is under attacker control. This occurs because of insufficient validation of companion files referenced during backup mounting.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmacrium.commacrium.com
Jul 31, 2025A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS.CVE-2025-46359 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpHigh 8.6
A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file.
- Product
- PowerCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025WP Database Backup: OS Command InjectionCVE-2019-25224 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
- Product
- WP Database Backup
- Fixed in
- 5.2
- What to do
- Update WP Database Backup to 5.2 or newer.
Full record and what to do →NVD recordblog.sucuri.netpacketstormsecurity.com
Jul 22, 2025Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file sCVE-2025-51463 · Other software · Aimstack · reported by MITREHigh 7
Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_instruction API, which is extracted without path validation during restoration.
- Product
- AIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2025Simple Backup: Arbitrary File DownloadCVE-2015-10134 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function. This is due to a lack of capability checks and file type validation. This makes it possible for attackers to download sensitive files such as the wp-config.php file from the affected site.
- Product
- Simple Backup
- Affected
- up to 2.7.10
- What to do
- Affects up to 2.7.10. Update Simple Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwordfence.com
Jul 16, 2025Bears Backup: Remote Code ExecutionCVE-2025-5396 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackup_ajax_handle() function not having a capability check, nor validating user supplied input passed directly to call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things. On WordPress sites running the Alone theme versions 7.8.4 and older, this can be chained with CVE-2025-5394 to install the Bears Backup plugin and achieve the same impact.
- Product
- Bears Backup
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Bears Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jul 14, 2025An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crCVE-2025-51651 · Other software · Chshcms · reported by MITREMedium 5.5
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Sensitive Information ExposureCVE-2020-36848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.14.9
- What to do
- Affects up to 1.14.9. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgraw.githubusercontent.com
Jul 10, 2025A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase().CVE-2025-52459 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.1
A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended requesCVE-2025-53473 · Other software · Nimesa · reported by vultures@jpcert.or.jpMedium 6.9
Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploited, unintended requests may be sent to internal servers.
- Product
- Nimesa Backup and Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4.CVE-2025-48501 · Other software · Nimesa · reported by vultures@jpcert.or.jpCritical 9.3
An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running.
- Product
- Nimesa Backup and Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary file uploadsCVE-2025-5961 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
- Product
- Migration, Backup, Staging – WPvivid Backup & Migration
- Affected
- up to 0.9.116
- What to do
- Affects up to 0.9.116. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jul 2, 2025An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API.CVE-2025-34076 · Other software · Microweber Ltd. · reported by VulnCheckMedium 6.1
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025EZ SQL Reports Shortcode Widget and DB Backup: Stored Cross-Site ScriptingCVE-2025-6462 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- EZ SQL Reports Shortcode Widget and DB Backup
- Affected
- up to 5.25.11
- What to do
- Affects up to 5.25.11. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 18, 2025A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions.CVE-2025-24287 · Other software · Veeam · reported by support@hackerone.comMedium 6.1
A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions.
- Product
- Backup for Microsoft Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.CVE-2025-24286 · Other software · Veeam · reported by support@hackerone.comHigh 7.2
A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.
- Product
- Backup and Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain userCVE-2025-23121 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user
- Product
- Backup and Recovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges dueCVE-2025-33108 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to the host operating system.
- Product
- Backup Recovery and Media Services for i
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup fileCVE-2025-49200 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it.CVE-2025-49199 · Other software · SICK AG · reported by psirt@sick.deHigh 8.8
The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable. They can redirect traffic that is meant to be internal to their own hosted services and gathering information.
- Product
- SICK Field Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Neutralization of Special Elements in the backup name field may allow OS command injection.CVE-2025-4653 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
- Product
- Pandora ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Backup and Staging by WP Time Capsule: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47477 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.23.
- Product
- Backup and Staging by WP Time Capsule
- Affected
- up to 1.22.23
- What to do
- Affects up to 1.22.23. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Everest Backup: Cross-Site Request Forgery (CSRF)CVE-2025-49238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through <= 2.3.3.
- Product
- Everest Backup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 22, 2025An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a speCVE-2025-43596 · Other software · MSP360 · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.5
An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary file backup target. Upgrade to MSP360 Backup 8.1.1.19 (released on 2025-05-15).
- Product
- Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.msp360.comhelp.msp360.com
May 21, 2025The ns_backup extension through 13.0.0 for TYPO3 allows XSS.CVE-2025-48206 · Other software · TYPO3 · reported by MITREMedium 6.1
The ns_backup extension through 13.0.0 for TYPO3 allows XSS.
- Product
- ns backup extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025The ns_backup extension through 13.0.0 for TYPO3 allows command injection.CVE-2025-48204 · Other software · TYPO3 · reported by MITREMedium 6.8
The ns_backup extension through 13.0.0 for TYPO3 allows command injection.
- Product
- ns backup extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.CVE-2025-48201 · Other software · TYPO3 · reported by MITREHigh 8.6
The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.
- Product
- ns backup extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management).CVE-2025-1417 · Other software · Proget · reported by cvd@cert.plMedium 4.6
In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of CVE-2025-1416. Successful exploitation requires UUID of a targeted backup, which cannot be brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
- Product
- Proget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2025A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.CVE-2025-1308 · Other software · Pure Storage · reported by psirt@purestorage.comHigh 8.4
A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.
- Product
- PX Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.purestorage.com
May 16, 2025A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.CVE-2025-4679 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.
- Product
- Active Backup for Microsoft 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.commodzero.com
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9663 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- CYAN Backup
- Fixed in
- 2.5.3
- What to do
- Update CYAN Backup to 2.5.3 or newer.
May 15, 2025CYAN Backup: Does not sanitise and escape some of its settingsCVE-2024-9662 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- CYAN Backup
- Fixed in
- 2.5.3
- What to do
- Update CYAN Backup to 2.5.3 or newer.
May 15, 2025Backup Database: Does not sanitise and escape some of its settingsCVE-2024-8702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Backup Database
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update Backup Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2025Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration BackupCVE-2024-57273 · Other software · Netgate · reported by MITREMedium 5.4
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key.
- Product
- Pfsense CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.brillantit.comdocs.netgate.com
May 13, 2025Improper input validation in the BackupBiosUpdate UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards before version R01.02.0003 mCVE-2025-20034 · Other software · reported by secure@intel.comMedium 5.6
Improper input validation in the BackupBiosUpdate UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards before version R01.02.0003 may allow a privileged user to potentially enable information disclosure via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal.CVE-2025-45239 · Other software · Qianfox · reported by MITREMedium 5.3
An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal.
- Product
- Foxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
May 5, 2025foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.CVE-2025-45240 · Other software · Qianfox · reported by MITREMedium 6.5
foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php.
- Product
- Foxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgitee.com
May 1, 2025An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'OnlinCVE-2025-43595 · Other software · MSP360 · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.5
An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22).
- Product
- Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.msp360.comraw.githubusercontent.com
Apr 30, 2025A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secrCVE-2025-27532 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comMedium 6.5
A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via multiple crafted HTTP requests.
- Product
- ctrlX OS - Device Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025WordPress Backup & Migration: Insertion of Sensitive Information into Log FileCVE-2025-24651 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Retrieve Embedded Sensitive Data.This issue affects WordPress Backup & Migration: from n/a through <= 1.5.3.
- Product
- WordPress Backup & Migration
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file.CVE-2024-55371 · Other software · Wallosapp · reported by MITRECritical 9.8
Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an authenticated attacker (being an administrator is not required) to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025WP STAGING Pro WordPress Backup: Information ExposureCVE-2025-3104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.
- Product
- WP STAGING Pro WordPress Backup
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update WP STAGING Pro WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwp-staging.comwordfence.com
Apr 15, 2025Vulnerability in Oracle Secure Backup (component: General).CVE-2025-21578 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.7
Vulnerability in Oracle Secure Backup (component: General). Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18.1.0.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
- Product
- Oracle Secure Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML reCVE-2025-32406 · Other software · NAKIVO · reported by MITREHigh 8.6
An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.
- Product
- Backup & Replication Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 20251-Click Backup & Restore Database: Missing AuthorizationCVE-2025-32246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1-Click Backup & Restore Database: from n/a through <= 1.0.3.
- Product
- 1-Click Backup & Restore Database
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update 1-Click Backup & Restore Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025pCloud Backup: Missing AuthorizationCVE-2025-31755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in josselynj pCloud Backup pcloud-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pCloud Backup: from n/a through <= 1.0.1.
- Product
- pCloud Backup
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update pCloud Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025MyDumper is a MySQL Logical Backup Tool.CVE-2025-30224 · Other software · mydumper · reported by GitHubMedium 5.1
MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client systems via a crafted server response to LOAD LOCAL INFILE query, leading to sensitive information disclosure when clients connect to untrusted MySQL servers without explicitly disabling the local infile capability. Mydumper has the local infile option enabled by default and does not have an option to disable it. This can lead to an unexpected arbitrary file read if the Mydumper tool connects to an untrusted server. This vulnerability is fixed in 0.18.2-8.
- Product
- mydumper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.