Refine your search

3 vulnerabilities found for Kemana Directory by C97net

CVE-2014-125138 (GCVE-0-2014-125138)
Vulnerability from cvelistv5
Published
2026-10-28 02:03
Modified
2026-10-28 02:03
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-434 - Unrestricted Upload of File with Dangerous Type
Summary
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
References
Impacted products
Vendor Product Version
C97net qEngine CMS Version: 0   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "qEngine CMS",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "6.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kemana Directory",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "1.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cart Engine",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:c97:cart_engine:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gjoko Krstic (LiquidWorm) of Zero Science Lab"
        }
      ],
      "datePublic": "2014-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T02:03:13.805Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5174: qEngine CMS 6.0.0 Remote Code Execution",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5174.html"
        },
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5178: Kemana Directory 1.5.6 Remote Code Execution",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5178.html"
        },
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5182: Cart Engine 3.0.0 Remote Code Execution",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5182.html"
        },
        {
          "name": "ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32511"
        },
        {
          "name": "ExploitDB-32507: Kemana Directory 1.5.6 Remote Code Execution",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32507"
        },
        {
          "name": "ExploitDB-32503: Cart Engine 3.0.0 Remote Code Execution",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32503"
        },
        {
          "name": "VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-unrestricted-file-upload-via-image-fields"
        }
      ],
      "title": "C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2014-125138",
    "datePublished": "2026-10-28T02:03:13.805Z",
    "dateReserved": "2026-10-27T21:50:43.766Z",
    "dateUpdated": "2026-10-28T02:03:13.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2014-125137 (GCVE-0-2014-125137)
Vulnerability from cvelistv5
Published
2026-10-28 02:03
Modified
2026-10-28 02:03
Severity ?
7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Summary
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
References
Impacted products
Vendor Product Version
C97net qEngine CMS Version: 0   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "qEngine CMS",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "6.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kemana Directory",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "1.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cart Engine",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:c97:cart_engine:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gjoko Krstic (LiquidWorm) of Zero Science Lab"
        }
      ],
      "datePublic": "2014-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T02:03:13.087Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5173: qEngine CMS 6.0.0 (task.php) Local File Inclusion Vulnerability",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5173.html"
        },
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5177: Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5177.html"
        },
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5181: Cart Engine 3.0.0 (task.php) Local File Inclusion Vulnerability",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5181.html"
        },
        {
          "name": "ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32511"
        },
        {
          "name": "ExploitDB-39129: qEngine 4.1.6/6.0.0 \u0027task.php\u0027 Local File Inclusion",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/39129"
        },
        {
          "name": "ExploitDB-32508: Kemana Directory 1.5.6 \u0027task.php\u0027 Local File Inclusion",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32508"
        },
        {
          "name": "ExploitDB-32504: Cart Engine 3.0.0 \u0027task.php\u0027 Local File Inclusion",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32504"
        },
        {
          "name": "VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-local-file-inclusion-via-admin-task-php"
        }
      ],
      "title": "C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2014-125137",
    "datePublished": "2026-10-28T02:03:13.087Z",
    "dateReserved": "2026-10-27T21:50:43.766Z",
    "dateUpdated": "2026-10-28T02:03:13.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2014-125136 (GCVE-0-2014-125136)
Vulnerability from cvelistv5
Published
2026-10-28 02:03
Modified
2026-10-28 16:12
Severity ?
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-530 - Exposure of Backup File to an Unauthorized Control Sphere
Summary
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
References
Impacted products
Vendor Product Version
C97net qEngine CMS Version: 0   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2014-125136",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T15:57:49.444303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T16:12:26.616Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "qEngine CMS",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "6.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kemana Directory",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "1.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cart Engine",
          "vendor": "C97net",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:c97:cart_engine:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gjoko Krstic (LiquidWorm) of Zero Science Lab"
        }
      ],
      "datePublic": "2014-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like \u0027Full Backup YYYYMMDD.sql\u0027 to download dumps containing user records and administrator password hashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-530",
              "description": "Exposure of Backup File to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T02:03:12.414Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5172: qEngine CMS 6.0.0 Database Backup Disclosure Exploit",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5172.html"
        },
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5176: Kemana Directory 1.5.6 Database Backup Disclosure Exploit",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5176.html"
        },
        {
          "name": "Zero Science Lab Advisory ZSL-2014-5180: Cart Engine 3.0.0 Database Backup Disclosure Exploit",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/advisories/ZSL-2014-5180.html"
        },
        {
          "name": "ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32511"
        },
        {
          "name": "ExploitDB-32509: Kemana Directory 1.5.6 Database Backup Disclosure",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32509"
        },
        {
          "name": "ExploitDB-32505: Cart Engine 3.0.0 Database Backup Disclosure",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/32505"
        },
        {
          "name": "VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-database-backup-exposure-via-admin-backup"
        }
      ],
      "title": "C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2014-125136",
    "datePublished": "2026-10-28T02:03:12.414Z",
    "dateReserved": "2026-10-27T21:50:43.766Z",
    "dateUpdated": "2026-10-28T16:12:26.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}