Drupal

Every one of the 166 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Drupal SQL InjectionCVE-2014-3704Drupal · 100% likely

   CWE-891 bounty report

2. The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial o…CVE-2014-9016Drupal · 79% likely
3. The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.CVE-2012-4554Drupal · 16% likely

   CWE-264

4. Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify…CVE-2006-2743Drupal · 11% likely
5. Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a fi…CVE-2005-3975Drupal · 4.8% likely
6. Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allow…CVE-2007-5416Drupal · 4.4% likely

   CWE-189

7. modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.CVE-2014-5267Drupal · 4.4% likely

   CWE-264

8. Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote att…CVE-2006-2831Drupal · 4.1% likely
9. install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php t…CVE-2007-5593Drupal · 3.8% likely

   CWE-94

10. includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arb…CVE-2008-6171Drupal · 3.7% likely

    CWE-16

11. Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session…CVE-2007-6752Drupal · 3.6% likely

    CWE-352

12. Cross-site scripting (XSS) vulnerability in Drupal 4.0.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.CVE-2002-1806Drupal · 3.5% likely
13. The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and acces…CVE-2007-0626Drupal · 3.4% likely
14. Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting.CVE-2005-2106Drupal · 3.2% likely
15. Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related t…CVE-2016-3171Drupal · 3.2% likely

    CWE-19

16. SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placehold…CVE-2008-3223Drupal · 3.2% likely

    CWE-89

17. The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which mi…CVE-2013-6385Drupal · 3.1% likely

    CWE-94

18. Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node ta…CVE-2011-2687Drupal · 3.1% likely

    CWE-264

19. In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. Thi…CVE-2017-6925Drupal · 3.0% likely
20. SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL…CVE-2015-6659Drupal · 3.0% likely

    CWE-89

21. The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which re…CVE-2012-2922Drupal · 3.0% likely

    CWE-200

22. CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam pro…CVE-2006-1225Drupal · 2.9% likely
23. Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers…CVE-2008-3222Drupal · 2.9% likely

    CWE-384

24. The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user…CVE-2016-6211Drupal · 2.8% likely

    CWE-264

25. The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining whi…CVE-2014-5019Drupal · 2.8% likely

    CWE-20

26. Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.CVE-2015-6661Drupal · 2.8% likely

    CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.