{"cve":"CVE-2007-3494","nvd":{"published":"2007-06-29T18:30:00.000","modified":"2026-06-16T22:42:09.540","status":"Modified","description":"Papoo CMS 3.6, and possibly earlier, does not verify user privileges when accessing the backend administration plugins, which allows remote authenticated users to (1) read the entire database by accessing the database backup plugin via a devtools/templates/newdump_backend.html argument in the template parameter to interna/plugin.php, (2) create plugins, (3) remove plugins, (4) enable debug mode, and have other unspecified impact.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/064171.html","http://osvdb.org/37542","http://securityreason.com/securityalert/2853","http://www.papoo.de/index/menuid/204/reporeid/215","http://www.securityfocus.com/archive/1/472213/100/0/threaded"],"products":["papoo:papoo"],"source":"nvd","synced_at":"2026-10-19T19:46:28.846926071+00:00"},"epss":{"cve":"CVE-2007-3494","score":0.02052,"percentile":0.81259,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}