High severity7.5NVD Advisory· Published Jul 21, 2017· Updated Jun 17, 2026
CVE-2015-3640
CVE-2015-3640
Description
phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:phpmybackuppro:phpmybackuppro:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phpmybackuppro:phpmybackuppro:*:*:*:*:*:*:*:*range: <=2.5
- (no CPE)range: <=2.5
Patches
Vulnerability mechanics
References
2- www.openwall.com/lists/oss-security/2015/05/04/4nvdMailing ListThird Party Advisory
- www.securitytracker.com/id/1032250nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.