Skip to content
BackEsc
Sign in

CWE-15 · weakness in Misconfiguration and Insecure Design

External Control of System or Configuration Setting

93 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

check available
1
likely to be exploited
4

Every one of the 93 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. mooSocial 3.1.8 - External Service InteractionCVE-2023-433232.1% likely
  2. An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbit…CVE-2024-39280Wavlink · CVSS 9.1 · 35% likely

    Wavlink

  3. php-svg-lib unsafe attributes merge when parsing `use` tagCVE-2023-50252dompdf · CVSS 8.3 · 24% likely

    Dompdf

  4. An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can…CVE-2024-38666Wavlink · CVSS 9.1 · 19% likely

    Wavlink

  5. Service ControlCVE-2024-51544ABB · CVSS 8.2 · 13% likely

    ABB

  6. Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server ModeCVE-2026-45087hahwul · CVSS 10 · 8.7% likely
  7. PostgreSQL PL/Perl environment variable changes execute arbitrary codeCVE-2024-10979Postgresql · CVSS 8.8 · 4.4% likely

    Postgresql

  8. An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary…CVE-2024-39602Wavlink · CVSS 9.1 · 2.4% likely

    Wavlink

  9. Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requ…CVE-2024-39800Wavlink · CVSS 9.1 · 1.9% likely

    Wavlink

  10. Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requ…CVE-2024-39798Wavlink · CVSS 9.1 · 1.9% likely

    Wavlink

  11. Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le…CVE-2024-39795Wavlink · CVSS 9.1 · 1.6% likely

    Wavlink

  12. Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le…CVE-2024-39793Wavlink · CVSS 9.1 · 1.6% likely

    Wavlink

  13. Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead t…CVE-2024-39790Wavlink · CVSS 9.1 · 1.6% likely

    Wavlink

  14. Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead t…CVE-2024-39788Wavlink · CVSS 9.1 · 1.6% likely

    Wavlink

  15. D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. An unauthenticated attacker on the local network may expl…CVE-2021-3707D-Link · 1.5% likely

    D-Link

  16. Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP requ…CVE-2024-39799Wavlink · CVSS 9.1 · 1.3% likely

    Wavlink

  17. Overwrite of builtin Cody commands facilitates RCECVE-2023-46248sourcegraph · CVSS 9.1 · 1.3% likely

    Sourcegraph

  18. PerFact OpenVPN-ClientCVE-2021-27406PerFact · CVSS 8.8 · 1.2% likely
  19. Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le…CVE-2024-39794Wavlink · CVSS 9.1 · 1.1% likely

    Wavlink

  20. Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead t…CVE-2024-39789Wavlink · CVSS 9.1 · 1.1% likely

    Wavlink

  21. Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validat…CVE-2023-32349Teltonika · CVSS 8 · 1.1% likely

    Teltonika

  22. AUVESY VersiondogCVE-2021-38453AUVESY · CVSS 9.1 · 1.1% likely

    AUVESY

  23. Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webuiCVE-2024-4326parisneo · CVSS 9.8 · 1.0% likely

    ParisNeo

  24. Post auth nginx configuration injection in Danfoss AK-SM8xxA SeriesCVE-2025-41452Danfoss · CVSS 6.8 · 0.9% likelycovered by CyberSIXT

    Danfoss4 articles1 article this week: Iranian cyber unit blamed for attacks on European refrigeration systems

  25. External Control of System or Configuration Setting in instantsoft/icms2CVE-2023-4704instantsoft · CVSS 8.8 · 0.9% likely

    InstantSoft

  26. Microsoft Exchange Server Spoofing VulnerabilityCVE-2026-118208Microsoft · CVSS 7.1 · 0.8% likely

    Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in