Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files
medium
The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is pre...
- CVSS:
- 5.9
- Affected:
- up to 1.8.4
- Fix:
- No patched version reported
- Disclosed:
- May 2, 2025
CVE-2025-4222 on NVD →
Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion
critical
The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the r...
- CVSS:
- 9.1
- Affected:
- up to 1.8.4
- Fix:
- No patched version reported
- Disclosed:
- Apr 23, 2025
CVE-2025-3065 on NVD →
Database Toolset [database-toolset] <= 1.8.4 (unfixed + closed)
unknown
[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset allows Path Traversal. This issue affects Database Toolset: from n/a through 1.8.4.
- Affected:
- up to 1.8.4
- Fix:
- No patched version reported
- Disclosed:
- Apr 11, 2025
CVE-2025-32633 on NVD →
Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion
critical
The Database Toolset plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execut...
- CVSS:
- 9.1
- Affected:
- up to 1.8.4
- Fix:
- No patched version reported
- Disclosed:
- Apr 9, 2025
CVE-2025-32633 on NVD →
Database Toolset [database-toolset] <= 1.8.4 (unfixed + closed)
unknown
- Affected:
- up to 1.8.4
- Fix:
- No patched version reported
CVE-2025-3065 on NVD →
Database Toolset [database-toolset] <= 1.8.4 (unfixed + closed)
unknown
- Affected:
- up to 1.8.4
- Fix:
- No patched version reported
CVE-2025-4222 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database