B2evolution

Every one of the 25 is a mark on the map. Named now: 1 to 25, most at risk first.

1. b2evolution CMS <6.11.6 - Open RedirectCVE-2020-22840B2evolution · 14% likely

   CWE-601

2. SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cf_na…CVE-2021-28242B2evolution · 5.0% likely

   CWE-89

3. The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this at…CVE-2017-5539B2evolution · 4.3% likely

   CWE-22

4. Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module.CVE-2020-22841B2evolution · 3.7% likely

   CWE-79

5. PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 through 1.9 beta allows remote attackers to execute arbitrary PHP code via a URL i…CVE-2006-6417B2evolution · 3.4% likely
6. SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] par…CVE-2013-2945B2evolution · 2.8% likely

   CWE-89

7. Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-o…CVE-2017-5480B2evolution · 2.5% likely

   CWE-22

8. Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the (1) inc_path parameter to (a) a_noskin.php,…CVE-2007-2358B2evolution · 2.5% likely
9. b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php.CVE-2016-8901B2evolution · 2.4% likely

   CWE-74

10. b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaini…CVE-2017-1000423B2evolution · 2.4% likely

    CWE-20

11. Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to inject arbitrary web script or HTML via the fm_filter parameter…CVE-2014-9599B2evolution · 2.2% likely

    CWE-79

12. Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) app_name parame…CVE-2006-6197B2evolution · 2.0% likely
13. The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.CVE-2016-9479B2evolution · 1.8% likely

    CWE-255

14. Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the core_subdir…CVE-2007-2681B2evolution · 1.5% likely
15. An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This al…CVE-2022-30935B2evolution · CVSS 9.1 · 1.4% likely

    CWE-330

16. b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstr…CVE-2011-3709B2evolution · 1.3% likely

    CWE-200

17. Cross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the re…CVE-2007-0175B2evolution · 1.3% likely

    CWE-79

18. Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body.CVE-2012-5911B2evolution · 1.3% likely

    CWE-79

19. Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink functi…CVE-2016-7149B2evolution · 1.2% likely

    CWE-79

20. Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web scri…CVE-2017-5553B2evolution · 1.2% likely

    CWE-79

21. Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML vi…CVE-2017-5494B2evolution · 1.2% likely

    CWE-79

22. SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.CVE-2012-5910B2evolution · 1.1% likely

    CWE-89

23. Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name.CVE-2016-7150B2evolution · 0.9% likely

    CWE-79

24. Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests…CVE-2013-7352B2evolution · 0.6% likely

    CWE-352

25. b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery (CSRF)CVE-2021-47800B2Evolution · CVSS 5.3 · 0.2% likely

    CWE-352

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.