File and Path Handling

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter.…CVE-2023-31689Wcms · CVSS 9.8 · 20% likely

   CWE-434

2. Directory traversal vulnerability in the getContent function in codes/wcms.php in w-CMS 2.01 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter.…CVE-2012-6522W-Cms · 4.0% likely

   CWE-22

3. Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php.CVE-2020-24136Wcms · 2.2% likely

   CWE-22

4. Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php parameter.CVE-2020-19902Wcms · 1.9% likely

   CWE-22

5. wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts functi…CVE-2019-11377Wcms · 1.7% likely

   CWE-434

6. Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the path parameter to wex/cssjs.php.CVE-2020-24137Wcms · 1.4% likely

   CWE-22

7. WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI.CVE-2019-14240Wcms · 0.8% likely

   CWE-22

8. WCMS Article Publishing Page CKEditor unrestricted uploadCVE-2025-2978Wcms · CVSS 6.3 · 0.6% likely

   CWE-434

9. WCMS Advertisement Image AdvadminController.php sub unrestricted uploadCVE-2025-3798Wcms · CVSS 4.7 · 0.5% likely

   CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.