CVE-2009-1941
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient...
CVE-2009-1941 is a medium vulnerability (CVSS 5.0) in Phpeasycode Pad Site Scripts, published June 5, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. No source names a fixed version.
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.
Exploit likelihood
What each source reports
NVD Score used
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.
- Record
CVE-2009-1941- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.
- Record
CVE-2009-1941- Updated
- 2026-11-02
EUVDEUVD-2009-1936 No score
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.
- Record
EUVD-2009-1936- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x736-3gm2-79w7 No score
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient...
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.
- Record
GHSA-x736-3gm2-79w7- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PAD Site Scripts 3.6 - Arbitrary Database Backup | 2009-06-01 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |