File and Path Handling

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.CVE-2021-39608Flatcore · 46% likely

   CWE-434

2. An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature.CVE-2019-10652Flatcore · 7.0% likely

   CWE-434

3. flatCore before 1.5.7 allows upload and execution of a .php file by an admin.CVE-2020-17452Flatcore · 2.4% likely

   CWE-434

4. acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted t…CVE-2017-8868Flatcore · 1.9% likely

   CWE-22

5. Unrestricted Upload of File with Dangerous Type in flatcore/flatcore-cmsCVE-2021-3745flatcore · CVSS 8 · 1.1% likely

   CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.