phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request…
Priority LOW 35CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts.
Why it matters now
EPSS 0.01226 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phpmybackuppro:phpmybackuppro:*:*:*:*:*:*:*:* | up to 2.5 | Vulnerable | PhpMyBackupPro |
- cpe:2.3:a:phpmybackuppro:phpmybackuppro:*:*:*:*:*:*:*:* Versions up to 2.5 Vulnerable ·PhpMyBackupPro
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-3640
- 2026-10-03 Alias added: GHSA-6qh9-p9x6-57f8
References
More Phpmybackuppro vulnerabilities
- TI-2015-03503 Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5… CVSS 3.0HIGH 7.5
- TI-2015-03079 phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows… CVSS 3.0HIGH 8.8
- TI-2015-03078 phpMyBackupPro before 2.5 does not validate integer input, which allows remote… CVSS 3.0HIGH 8.8
- TI-2015-03502 Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.4… CVSS 3.0HIGH 7.5
- TI-2015-03077 SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5… CVSS 3.0HIGH 8.1
- TI-2009-03841 Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2015-3640 · CVE Program
- CVE-2015-3640 · NVD
- FIRST EPSS
- GHSA-6qh9-p9x6-57f8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences