Skip to content
BackEsc
Sign in

connection · two weakness classes

Command and Code Injection with File and Path Handling

111 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy: this is what the line between them on the dial stands for.

check available
6
likely to be exploited
5

Every one of the 111 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. SPIP BigUp Plugin - Remote Code ExecutionCVE-2024-8517SPIP · CVSS 9.8 · 95% likely

    CWE-73SPIP

  2. elFinder 2.1.58 - Remote Code ExecutionCVE-2021-32682Studio-42 · CVSS 9.8 · 68% likely

    CWE-918Studio-42

  3. WordPress Pie Register <= 3.7.1.4 - Authentication BypassCVE-2025-34077Genetech Solutions · CVSS 10 · 17% likely

    CWE-434

  4. n8n >= 0.123.0 and < 1.121.3 - Remote Code ExecutionCVE-2026-21877n8n-io · CVSS 10 · 5.4% likely

    CWE-94N8n-Io

  5. osCommerce 2.3.4.1 - Remote Code ExecutionCVE-2018-25114osCommerce · CVSS 9.3 · 4.6% likely

    CWE-434Os Commerce

  6. REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey PassthruCVE-2026-90817Vanderbilt University · CVSS 9.8 · 3.7% likely

    CWE-94

  7. RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)CVE-2026-2701Progress · CVSS 9.1 · 55% likelycovered by CyberSIXT

    CWE-434Progress Software

  8. Path Traversal leading to RCECVE-2025-8356Xerox · CVSS 9.8 · 23% likely

    CWE-22Xerox

  9. ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root accessCVE-2022-0902ABB · CVSS 8.1 · 17% likely

    CWE-22ABB

  10. Langflow has an Arbitrary File Write (RCE) via v2 APICVE-2026-33309langflow-ai · CVSS 10 · 14% likely

    CWE-22Langflow-Ai

  11. An authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by an unintended side effect of the Samba functionality, potentially leading to allow…CVE-2025-59366ASUS · CVSS 9.2 · 12% likely

    CWE-22ASUS

  12. Directory traversal vulnerability in include/unverified.inc.php in Linux Web Shop (LWS) php User Base 1.3beta allows remote attackers to include and execute arbitrary local files…CVE-2008-72406.3% likely

    CWE-22

  13. Bolt CMS Authenticated Remote Code Execution via Profile Injection and File RenameCVE-2025-34086Bolt · CVSS 7.5 · 4.3% likely

    CWE-94Bolt

  14. Pipenv's requirements.txt parsing allows malicious index url in commentsCVE-2022-21668pypa · CVSS 8 · 3.9% likely

    CWE-78Pypa

  15. Authenticated Remote Code Execution via Arbitrary File UploadCVE-2026-24897ErugoOSS · CVSS 10 · 3.3% likely

    CWE-22

  16. go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.CVE-2022-303213.1% likely

    CWE-22

  17. PAN-OS: OS command injection or arbitrary file deletion vulnerabilityCVE-2020-2008Palo Alto Networks · CVSS 7.2 · 2.8% likely

    CWE-73Palo Alto Networks

  18. It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially…CVE-2019-10182IcedTea · CVSS 8.2 · 2.7% likely

    CWE-22IcedTea

  19. Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers to include arbitrary files via a .. (dot dot) in the page p…CVE-2007-53212.3% likely

    CWE-22

  20. Kiteworks Email Protection Gateway remote code executionCVE-2026-102097Kiteworks · CVSS 7.2 · 2.2% likely

    CWE-22Kiteworks

  21. eyoom builder Remote Code Execution VulnerabilityCVE-2022-41158eyoom Co.,Ltd · CVSS 7.2 · 2.1% likely

    CWE-22

  22. Directory traversal vulnerability in Apple Safari before 5.1.1 allows remote attackers to execute arbitrary JavaScript code, in a Safari Extensions context, via a crafted safari-e…CVE-2011-32292.1% likely

    CWE-22

  23. ContentKeeper Web Appliance < 125.10 RCE via mimencodeCVE-2009-20011ContentKeeper Technologies · CVSS 10 · 1.9% likely

    CWE-434

  24. A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HT…CVE-2025-63414Allskyteam · CVSS 10 · 1.8% likely

    CWE-22

  25. Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editorCVE-2026-73697Control Web Panel · CVSS 8.8 · 1.8% likelycovered by CyberSIXT

    CWE-78Control Web Panel1 article

  26. Remote Code Execution & File Deletion in Asset UploadsCVE-2024-47051Mautic · CVSS 9.1 · 1.8% likely

    CWE-23Mautic

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in