File and Path Handling

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then providing a .php pathname within fileurl JS…CVE-2018-16731Chshcms · 1.5% likely

   CWE-434

2. CScms 4.1 allows arbitrary directory deletion via a dir=..\\ substring to plugins\sys\admin\Plugins.php.CVE-2018-17125Chshcms · 1.4% likely

   CWE-22

3. chshcms mccms Backups.php restore_del path traversalCVE-2025-5328chshcms · CVSS 5.4 · 1.3% likely

   CWE-22

4. MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commandsCVE-2025-51818Chshcms · CVSS 5.4 · 0.3% likely

   CWE-552

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.