Input Validation and Logic

Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.

1. WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route ConfusionCVE-2026-63030WordPress · CVSS 9.8 · 11% likelycovered by CyberSIXT

   CWE-436CyberXeroRed Heron4 articles1 article this week: SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine

2. WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to exe…CVE-2007-1277Wordpress · 28% likely

   CWE-20

3. wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated user…CVE-2008-5695Wordpress · 12% likely

   CWE-20

4. WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for…CVE-2018-1000773Wordpress · 8.2% likely

   CWE-20

5. is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a n…CVE-2020-28037Wordpress · 8.1% likely

   CWE-754

6. WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted stri…CVE-2013-4339Wordpress · 7.9% likely

   CWE-20

7. The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.CVE-2008-4616Wordpress · 7.3% likely

   CWE-20

8. WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not prop…CVE-2008-4106Wordpress · 5.5% likely

   CWE-20

9. wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by…CVE-2019-20041Wordpress · 4.5% likely

   CWE-20

10. Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload sect…CVE-2008-2392Wordpress · 4.3% likely

    CWE-20

11. In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.CVE-2017-9065Wordpress · 4.1% likely

    CWE-20

12. wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF)…CVE-2014-9038Wordpress · 3.9% likely

    CWE-20

13. WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via…CVE-2017-1000600Wordpress · 3.8% likely

    CWE-20

14. In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.CVE-2018-20152Wordpress · 3.6% likely

    CWE-20

15. The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attac…CVE-2011-4957Wordpress · 3.2% likely

    CWE-20

16. WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.CVE-2009-2431Wordpress · 2.9% likely

    CWE-20

17. In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.CVE-2017-6815Wordpress · 2.8% likely

    CWE-20

18. The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, whi…CVE-2013-5738Wordpress · 2.4% likely

    CWE-20

19. WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveragin…CVE-2016-9263Wordpress · 2.2% likely

    CWE-20

20. Specially crafted filenames in WordPress leading to XSSCVE-2020-11026WordPress · CVSS 8.7 · 2.1% likely

    CWE-707

21. WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier f…CVE-2011-3127Wordpress · 1.5% likely

    CWE-20

22. Cross-site scripting (XSS) in Search block in WordPressCVE-2020-11030WordPress · CVSS 6.4 · 1.4% likely

    CWE-707

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.