Information Disclosure Vulnerability in C97net qEngine CMS, Kemana Directory, and Cart Engine
CVE-2014-125136

8.2HIGH

Key Information:

Vendor

C97net

Status
Qengine Cms
Kemana Directory
Cart Engine
Vendor
CVE Published:
28 October 2026

What is CVE-2014-125136?

A vulnerability exists in C97net qEngine CMS versions up to 6.0.0, Kemana Directory versions up to 1.5.6, and Cart Engine versions up to 3.0.0 that allows for unauthorized access to database backups stored in the web-accessible /admin/backup directory. This flaw enables unauthenticated attackers to list all backup files or predict filenames based on dates, potentially leading to the download of sensitive database dumps containing user records and hashed administrator passwords.

Affected Version(s)

Cart Engine 0 <= 3.0.0

Kemana Directory 0 <= 1.5.6

qEngine CMS 0 <= 6.0.0

References

https://www.zeroscience.mk/advisories/ZSL-2014-5172.html
third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5176.html
third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5180.html
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gjoko Krstic (LiquidWorm) of Zero Science Lab
.