CVE-2014-125136
Medium · 5.9CVSS
5.9
EPSS
0.4%
Published
Oct 28, 2026
CISA due date
—
The record
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-13514 A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. CWE-530
- CVE-2024-56462 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to… CWE-530
- CVE-2026-2974 A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. CWE-530