An information disclosure flaw in the /admin/backup directory allows unauthenticated attackers to list or guess filenames that reveal database backup files. These dumps contain user records and administrator password hashes, exposing sensitive credentials and enabling further compromise. The weakness is classified as CWE‑530, indicating uncontrolled exposure of backup material.

The vulnerability affects C97net qEngine CMS versions up to 6.0.0, Kemana Directory up to 1.5.6, and Cart Engine up to 3.0.0. All these products expose the /admin/backup location where database dumps reside without requiring authentication, making the files publicly accessible.

With a CVSS score of 8.2, the flaw is considered high severity; the EPSS score is not available and it is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability from any external network by sending standard HTTP requests to /admin/backup, automatically listing files or guessing date‑based filenames. Public exploits documented on Exploit‑DB demonstrate that the vulnerability is practical and can be automated, indicating a high risk that demands urgent remediation.