Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for JetBackup by Unknown

    CVE-2026-19454 (GCVE-0-2026-19454)

    Vulnerability from cvelistv5 – Published: 2026-08-27 06:00 – Updated: 2026-08-27 06:00
    VLAI
    Title
    JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
    Summary
    The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/1f5480c1-260a-40… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown JetBackup Affected: 3.1.18.8 , < 3.1.23.5 (semver)
    		Create a notification for this product.
    Credits
    Akshat Parikh (SN1PER) WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetBackup",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.1.23.5",
              "status": "affected",
              "version": "3.1.18.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Akshat Parikh (SN1PER)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetBackup  WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network\u0027s main site who is not a Super Admin to download a full backup of the entire network, including every site\u0027s data and the shared webroot."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T06:00:17.928Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/1f5480c1-260a-40ce-9938-112746f9e8e8/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19454",
    "datePublished": "2026-08-27T06:00:17.928Z",
    "dateReserved": "2026-08-10T14:10:21.471Z",
    "dateUpdated": "2026-08-27T06:00:17.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-7165 (GCVE-0-2023-7165)

    Vulnerability from cvelistv5 – Published: 2024-02-27 08:30 – Updated: 2024-08-09 19:09
    VLAI
    Title
    JetBackup < 2.0.9.9 - Directory Listing Exposing Backups
    Summary
    The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-08-09 19:07 UTC
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/ad1ef4c5-60c1-47… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown JetBackup Affected: 0 , < 2.0.9.9 (semver)
    		Create a notification for this product.
    jetbackup jetbackup Affected: 0 , < 2.0.9.9 (semver)
        cpe:2.3:a:jetbackup:jetbackup:*:*:*:*:*:wordpress:*:*
    		Create a notification for this product.
    Credits
    Dmitrii Ignatyev WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:50:08.310Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "exploit",
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:jetbackup:jetbackup:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jetbackup",
            "vendor": "jetbackup",
            "versions": [
              {
                "lessThan": "2.0.9.9",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-7165",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-09T19:07:36.266510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-09T19:09:11.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "JetBackup",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.0.9.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetBackup WordPress plugin before 2.0.9.9 doesn\u0027t use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-200 Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-27T08:30:30.074Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/ad1ef4c5-60c1-4729-81dd-f626aa0ce3fe/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "JetBackup \u003c 2.0.9.9 - Directory Listing Exposing Backups",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2023-7165",
    "datePublished": "2024-02-27T08:30:30.074Z",
    "dateReserved": "2023-12-28T18:57:57.483Z",
    "dateUpdated": "2024-08-09T19:09:11.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}