Expressionengine

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user wit…CVE-2020-13443Expressionengine · 4.1% likely

   CWE-4341 bounty report

2. ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under…CVE-2021-27230Expressionengine · 2.8% likely

   CWE-94

3. Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to inject arbitrary we…CVE-2009-1070Expressionengine · 1.7% likely

   CWE-79

4. In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.CVE-2023-22953Expressionengine · 1.4% likely
5. In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and…CVE-2021-33199Expressionengine · 1.4% likely

   CWE-20

6. Cross-site scripting (XSS) vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameter.CVE-2008-0201Expressionengine · 1.3% likely

   CWE-79

7. CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attack…CVE-2008-0202Expressionengine · 1.2% likely

   CWE-94

8. Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user needs member creation/admin control panel access to execute t…CVE-2020-8242Expressionengine · 0.9% likely

   CWE-891 bounty report

9. ExpressionEngine before 4.3.5 has reflected XSS.CVE-2018-17874Expressionengine · 0.6% likely

   CWE-79

10. Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure.CVE-2021-44534ExpressionEngine · CVSS 6.5 · 0.6% likely

    CWE-2001 bounty report

11. EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injectionCVE-2017-1000160Expressionengine · 0.5% likely

    CWE-79

12. SQL Injection vulnerability in the Structure for Admin authenticated userCVE-2025-59473ExpressionEngine · CVSS 6 · 0.3% likely

    CWE-891 bounty report

13. ExpressionEngine before 7.4.11 allows XSS.CVE-2024-38454Expressionengine · CVSS 6.1 · 0.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.