File and Path Handling

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

1. Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion. This fla…CVE-2023-21418Axis Communications AB · CVSS 7.1 · 0.8% likely

   CWE-35

2. Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API overlay_del.cgi is vulnerable to path traversal attacks that allows for file deletion. This fl…CVE-2023-21415Axis Communications AB · CVSS 6.5 · 0.7% likely

   CWE-35

3. Insufficient input validation in VAPIX API create_overlay.cgiCVE-2023-5800Axis Communications AB · CVSS 5.4 · 0.7% likely

   CWE-35

4. Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder de…CVE-2023-21417Axis Communications AB · CVSS 7.1 · 0.7% likely

   CWE-35

5. Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to bl…CVE-2023-21416Axis Communications AB · CVSS 7.1 · 0.7% likely

   CWE-35

6. Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing for a possible command…CVE-2024-47259Axis Communications AB · CVSS 3.5 · 0.5% likely

   CWE-434

7. 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips th…CVE-2024-47260Axis Communications AB · CVSS 6.5 · 0.4% likely

   CWE-641

8. Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the l…CVE-2024-0067Axis Communications AB · CVSS 4.3 · 0.4% likely

   CWE-35

9. AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its curr…CVE-2022-23410Axis Communications AB · 0.4% likely

   CWE-427

10. The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the in…CVE-2025-5718Axis Communications AB · CVSS 6.8 · 0.4% likely

    CWE-59

11. It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after auth…CVE-2025-8998Axis Communications AB · CVSS 3.1 · 0.2% likely

    CWE-73

12. Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to e…CVE-2025-1056Axis Communications AB · CVSS 6.1 · 0.2% likely

    CWE-73

13. An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.CVE-2025-12757Axis Communications AB · CVSS 4.6 · 0.2% likely

    CWE-22

14. An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be…CVE-2025-5454Axis Communications AB · CVSS 6.4 · 0.2% likely

    CWE-35

15. An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be…CVE-2026-0804Axis Communications AB · CVSS 6.7 · 0.1% likely

    CWE-35

16. AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating system. This vulner…CVE-2025-10714Axis Communications AB · CVSS 8.4 · 0.1% likely

    CWE-428

17. A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authen…CVE-2026-9063Axis Communications AB · CVSS 6.7 · 0.1% likely

    CWE-427

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.