Insertion of Sensitive Information into Externally-Accessible File or Directory

Every one of the 107 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Brother MFC-L9570CDW - Information DisclosureCVE-2024-51977Brother Industries, Ltd · CVSS 5.3 · 47% likely

   Brother Industries, Ltd

2. Active Directory Integration WP Plugin < 4.1.10 - Log DisclosureCVE-2023-5003Active Directory Integration / LDAP Integration · CVSS 7.5 · 27% likely
3. A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause…CVE-2019-6851Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware ver… · 29% likely
4. A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remot…CVE-2017-9947APOGEE PXC and TALON TC BACnet Automation Controllers All versions <V3.5 · CVSS 5.3 · 8.2% likely
5. The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to acc…CVE-2018-11798Apache Software Foundation · 4.7% likely

   Apache

6. File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authentic…CVE-2017-16770Synology · 1.8% likely

   Synology

7. A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary file…CVE-2019-7618Elastic · 1.5% likely

   Elastic

8. Advantech WebAccess File and Directory Information ExposureCVE-2014-0772Advantech · CVSS 5 · 1.4% likely

   Advantech

9. Advantech WebAccess File and Directory Information ExposureCVE-2014-0771Advantech · CVSS 7.5 · 1.4% likely

   Advantech

10. Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via…CVE-2016-103991.4% likely
11. Apache NiFi: Potential Insertion of MongoDB Password in Provenance RecordCVE-2025-27017Apache Software Foundation · CVSS 6.9 · 1.3% likely

    Apache

12. Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration VulnerabilityCVE-2019-12623Cisco · CVSS 4.3 · 1.2% likely

    Cisco

13. Cisco Unified Communications Manager Information Disclosure VulnerabilityCVE-2021-1406Cisco · CVSS 4.9 · 1.1% likely

    Cisco

14. File disclosure in hbsCVE-2021-32822pillarjs · CVSS 4 · 1.0% likely
15. Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacke…CVE-2019-10320Jenkins project · 1.0% likely

    Jenkins

16. Post-Auth External Entity Expansion (XXE)CVE-2021-21250theonedev · CVSS 7.7 · 0.9% likely

    Theonedev

17. Campcodes Farm Management System file information disclosureCVE-2025-11079Campcodes · CVSS 5.3 · 0.9% likely

    Campcodes

18. Microsoft Windows Search Component Information Disclosure VulnerabilityCVE-2026-69507Microsoft · CVSS 5.7 · 0.9% likely

    Microsoft

19. In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script filesCVE-2025-57734JetBrains · CVSS 4.3 · 0.9% likely

    JetBrains

20. ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege EscalationCVE-2016-20024ZKTeco Inc. · CVSS 9.8 · 0.8% likely

    ZKTeco

21. RRJ Nueva Ecija Engineer Online Portal file information disclosureCVE-2024-0191RRJ · CVSS 5.3 · 0.8% likely

    RRJ

22. angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backendCVE-2023-28444kyubisation · CVSS 9.9 · 0.8% likely
23. Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.CVE-2018-169700.7% likely
24. Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmailCVE-2023-4595BVRP Software · CVSS 7.5 · 0.7% likely
25. Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory TraversalCVE-2023-7062Advanced File Manager · CVSS 8.8 · 0.7% likely
26. cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).CVE-2018-209320.7% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.