Live › vulnerability › CVE-2014-125136
Go to dashboardThree PHP shopping and CMS products (qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0) leave database backups in a web-accessible /admin/backup directory. An unauthenticated attacker can list the directory or guess date-based filenames and download dumps containing user records and administrator password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Sites running C97net qEngine CMS up to 6.0.0, Kemana Directory up to 1.5.6, or Cart Engine up to 3.0.0 where the backup directory sits under the public web root. Installations that keep backups outside the web root or deny that path are not exposed by this issue.
No product ranges from the sources yet.
/admin/backup/ on the site and see whether the directory listing or any .sql file is servedFull Backup YYYYMMDD.sql in the web root or the admin backup folder/admin/backup at the web serverEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
This page as .md · .json · in your agent: get_signal("CVE-2014-125136")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.