File and Path Handling

Every one of the 3 is a mark on the map. Named now: 1 to 3, most at risk first.

1. A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary…CVE-2017-9428Bigtreecms · 2.0% likely

   CWE-22

2. Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.CVE-2017-7695Bigtreecms · 2.0% likely

   CWE-434

3. Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.CVE-2017-9364Bigtreecms · 1.3% likely

   CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.