CVE-2014-2996: Xcloner

High severity, CVSS 7.1. EPSS: 9.9% chance of exploitation in the next 30 days.

XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have the privileges to execute code. NOTE: this can be leveraged by remote attackers using CVE-2014-2579.

Affected products

• Xcloner Xcloner: up to and including 3.5

Published 2014-04-25. Last modified 2026-06-17.