Command and Code Injection

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

1. PHP CGI v5.3.12/5.4.2 Remote Code ExecutionCVE-2012-1823PHP · CVSS 9.8 · 100% likely

   CWE-771 bounty report

2. PHP CGI - Argument InjectionCVE-2024-4577PHP Group · CVSS 9.8 · 100% likelycovered by CyberSIXT

   CWE-781 bounty report

3. WordPress PHPMailer < 5.2.18 - Remote Code ExecutionCVE-2016-10033PHP · CVSS 9.8 · 100% likely

   CWE-881 bounty report

4. University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/ima…CVE-2018-19518Php · 96% likelycovered by CyberSIXT

   CWE-881 article

5. Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such…CVE-2005-1921Php · 79% likely

   CWE-94

6. Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for t…CVE-2006-4812Php · 21% likely

   CWE-94

7. PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrar…CVE-2001-1246Php · 9.7% likely

   CWE-88

8. The perl extension in PHP does not follow safe_mode restrictions, which allows context-dependent attackers to execute arbitrary code via the Perl eval function. NOTE: this might o…CVE-2007-4596Php · 8.2% likely

   CWE-94

9. The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error…CVE-2007-1581Php · 8.0% likely

   CWE-94

10. The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS co…CVE-2015-4642Php · 6.0% likely

    CWE-78

11. The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted UR…CVE-2011-3379Php · 5.0% likely

    CWE-94

12. The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass int…CVE-2007-5653Php · 4.8% likely

    CWE-78

13. PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a…CVE-2007-4782Php · 4.7% likely

    CWE-94

14. Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session e…CVE-2006-0207Php · 4.3% likely

    CWE-94

15. PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)CVE-2024-8926PHP Group · CVSS 8.1 · 3.7% likely

    CWE-78

16. The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to execut…CVE-2010-1868Php · 3.0% likely

    CWE-94

17. Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g.…CVE-2002-0985Php · 3.0% likely

    CWE-88

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.