Vulnerabilities > Xcloner > Xcloner > 3.1.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-01-01 | CVE-2020-35950 | Cross-Site Request Forgery (CSRF) vulnerability in Xcloner An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. | 6.8 |
| 2015-06-10 | CVE-2014-8607 | Information Exposure vulnerability in Xcloner 3.1.1/3.5.1 The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command. | 2.1 |
| 2015-06-10 | CVE-2014-8606 | Path Traversal vulnerability in Xcloner 3.1.1/3.5.1 Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. | 4.0 |
| 2015-06-10 | CVE-2014-8605 | Permissions, Privileges, and Access Controls vulnerability in Xcloner 3.1.1/3.5.1 The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/. | 5.0 |
| 2015-06-10 | CVE-2014-8604 | Information Exposure vulnerability in Xcloner 3.1.1/3.5.1 The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors. | 5.0 |
| 2015-06-10 | CVE-2014-8603 | Improper Input Validation vulnerability in Xcloner 3.1.1/3.5.1 cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable. | 6.5 |