Phpmybackuppro is a narrowly scoped backup plugin for WordPress whose vulnerability profile concentrates in a single product and centers on web application input-handling and access-control flaws. The recurring weakness classes—path traversal, cross-site scripting, code injection, improper input validation, and SQL injection—reflect the typical risks of a server-side WordPress extension handling user input and file operations. Vulnerabilities affecting this vendor frequently acquire public exploit code; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpmybackuppro over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-4181HIGH Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: | Aug 25, 2017 | 7.5 | 33 | NO | YES |
CVE-2009-4050MEDIUM Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter. NO | Nov 23, 2009 | 5.0 | 27 | NO | YES |
CVE-2015-3637HIGH SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5 allows remote attackers to execute arbitrary SQL commands via the username and password paramet | Dec 28, 2017 | 8.1 | 26 | NO | NO |
CVE-2024-5415HIGH A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' par | May 28, 2024 | 7.1 | 22 | NO | NO |
CVE-2024-5414HIGH A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/get_file.php, 'view' parameter. Thi | May 28, 2024 | 7.1 | 22 | NO | NO |
CVE-2015-3639HIGH phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user | Jul 21, 2017 | 8.8 | 22 | NO | NO |
CVE-2015-3638HIGH phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and pe | Jul 21, 2017 | 8.8 | 22 | NO | NO |
CVE-2024-5413MEDIUM A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/scheduled.php, all parameters. This | May 28, 2024 | 6.1 | 20 | NO | NO |
CVE-2015-4180HIGH Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: | Aug 25, 2017 | 7.5 | 20 | NO | NO |
CVE-2015-3640HIGH phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web- | Jul 21, 2017 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpmybackuppro.
Media articles that mention a CVE ID that affects a product developed by Phpmybackuppro — matched by CVE ID, not by vendor name.