Incomplete Identification of Uploaded File Variables (PHP)

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2023-38947Wbce · CVSS 7.2 · 0.5% likely

   Wbce

2. File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leadin…CVE-2025-67084Invoiceplane · CVSS 9.9 · 0.4% likely

   InvoicePlane

3. In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.CVE-2024-29858Misp-Project · CVSS 9.8 · 0.4% likely

   MISP

4. An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. 20240323 and before allows attackers to execute arbitrary code via the exportpdf.php co…CVE-2024-31601CVSS 9.8 · 0.4% likely
5. Perspective 5.0.0 DoS via VirtualServer Protocol DispatcherCVE-2026-67198perspective-dev · CVSS 7.5 · 0.3% likely

   Perspective-Dev

6. Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physi…CVE-2025-59402Flocksafety · CVSS 5.4 · 0.2% likely

   Flocksafety

7. File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, i…CVE-2025-52130CVSS 5.4 · 0.2% likely
8. UnoPim Stored XSS : Cookie hijacking through Create User functionCVE-2024-52305unopim · CVSS 6.5 · 0.2% likely

   Unopim

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.