cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2023-5505,https://securityvulnerability.io/vulnerability/CVE-2023-5505,BackWPup Plugin Vulnerable to Directory Traversal,"The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.",Wordpress,BackWPup – WordPress Backup & Restore Plugin,6.8,MEDIUM,0.0006799999973736703,false,,false,false,false,,false,false,2024-08-17T08:37:24.102Z,0
CVE-2023-7164,https://securityvulnerability.io/vulnerability/CVE-2023-7164,"Visitors can access and download site backups, putting data at risk","The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.",Wordpress,BackWPup,,,0.0004299999854993075,false,,false,false,true,true,false,false,2024-04-08T17:28:14.247Z,0
CVE-2023-5775,https://securityvulnerability.io/vulnerability/CVE-2023-5775,Plaintext Storage of Backup Destination Password Vulnerability Affects BackWPup Plugin,"The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with administrator-level access, to retrieve the password from the password input field in the UI or from the options table where the password is stored.",Wordpress,BackWPup – WordPress Backup Plugin,2.2,LOW,0.0004299999854993075,false,,false,false,false,,false,false,2024-02-26T16:27:00.000Z,0
CVE-2023-5504,https://securityvulnerability.io/vulnerability/CVE-2023-5504,Directory Traversal Vulnerability in BackWPup Plugin for WordPress by Inpsyde,"The BackWPup plugin for WordPress, produced by Inpsyde, contains a Directory Traversal vulnerability allowing authenticated attackers to store backups in arbitrary folders on the server. This issue affects versions up to and including 4.0.1, enabling attackers to manipulate the Log File Folder settings. Unless already present, running the first backup job can create an index.php and a .htaccess file in the chosen backup directory, which could result in potential denial of service for other sites hosted on the same server. The implications of this vulnerability necessitate immediate attention for users and administrators of the affected plugin.",Wordpress,BackWPup – WordPress Backup Plugin,8.7,HIGH,0.0007099999929778278,false,,false,false,false,,false,false,2024-01-11T08:33:06.702Z,0
CVE-2017-2551,https://securityvulnerability.io/vulnerability/CVE-2017-2551,,Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.,Wordpress,BackWPup,7.5,HIGH,0.005289999768137932,false,,false,false,false,,false,false,2017-09-28T01:29:00.000Z,0
CVE-2013-4626,https://securityvulnerability.io/vulnerability/CVE-2013-4626,,Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php.,Wordpress,BackWPup Plugin,,,0.00343999988399446,false,,false,false,false,,false,false,2013-09-26T15:55:00.000Z,0
CVE-2011-4342,https://securityvulnerability.io/vulnerability/CVE-2011-4342,,PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.,Wordpress,BackWPup,,,0.09470999985933304,false,,false,false,false,,false,false,2012-10-08T18:55:00.000Z,0
CVE-2011-5208,https://securityvulnerability.io/vulnerability/CVE-2011-5208,,Multiple directory traversal vulnerabilities in the BackWPup plugin before 1.4.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the wpabs parameter to (1) app/options-view_log-iframe.php or (2) app/options-runnow-iframe.php.,Wordpress,BackWPup,,,0.008860000409185886,false,,false,false,false,,false,false,2012-10-08T18:55:00.000Z,0