High severity7.5NVD Advisory· Published Jul 21, 2017· Updated May 13, 2026
CVE-2015-3640
CVE-2015-3640
Description
phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.openwall.com/lists/oss-security/2015/05/04/4nvdMailing ListThird Party Advisory
- www.securitytracker.com/id/1032250nvdThird Party AdvisoryVDB Entry
News mentions
0No linked articles in our index yet.