Skip to content
BackEsc
Sign in

CWE-552 · weakness in File and Path Handling

Files or Directories Accessible to External Parties

449 CVEs · 5 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
5
check available
21
likely to be exploited
7

Every one of the 449 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File ReadCVE-2026-21589Atlassian · CVSS 9.3 · 100% likelycovered by CyberSIXT

    Atlassian15 articles

  2. Apache Flink - Local File InclusionCVE-2020-17519Apache Software Foundation · CVSS 9.1 · 98% likely

    Apache

  3. Gladinet CentreStack & TrioFox - Local File InclusionCVE-2025-11371Gladinet · CVSS 7.5 · 92% likely

    Gladinet

  4. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.CVE-2016-3715ImageMagick · CVSS 5.5 · 75% likely

    ImageMagick

  5. Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files,…CVE-2017-16651Roundcube · CVSS 7.8 · 46% likely

    Roundcube

  6. Intelbras WRN 150 - Authentication BypassCVE-2017-1494261% likely
  7. Weaver OA 9.5 - Information DisclosureCVE-2023-2766Weaver · CVSS 5.3 · 54% likely

    Weaver

  8. WordPress Plugin File Manager (wp-file-manager) Backup DisclosureCVE-2020-2431216% likely
  9. Dolibarr Unauthenticated Contacts Database TheftCVE-2023-3356815% likely
  10. Reolink E1 Zoom Camera <=3.0.0.716 - Private Key DisclosureCVE-2021-401498.3% likely
  11. uDraw <3.3.3 - Local File InclusionCVE-2022-0656Web To Print Shop : uDraw · 7.9% likely
  12. PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File InclusionCVE-2024-6911PerkinElmer · CVSS 8.7 · 4.9% likely
  13. 74cmsSE v3.4.1 - Arbitrary File ReadCVE-2022-262714.5% likely
  14. Reolink E1 Zoom Camera <=3.0.0.716 - Information DisclosureCVE-2021-401504.0% likely
  15. Cuppa CMS v1.0 - Local File InclusionCVE-2022-254973.7% likely
  16. WordPress Welcart e-Commerce <2.8.5 - Arbitrary File AccessCVE-2022-4140Welcart e-Commerce · CVSS 7.5 · 3.2% likely
  17. WAVLINK Quantum D4G (WL-WN531G3) - Information DisclosureCVE-2022-44356CVSS 7.5 · 3.1% likely
  18. WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File ReadCVE-2022-33901MultiSafepay · CVSS 5.3 · 2.8% likely
  19. WAVLINK WN530HG4 - Improper Access ControlCVE-2022-340492.7% likely
  20. ZKTeco BioTime <= 9.0.1 - Privilege EscalationCVE-2023-38952CVSS 7.5 · 2.7% likely
  21. Edito CMS - Sensitive Data LeakCVE-2024-4836Edito · CVSS 7.5 · 2.6% likely

    Edito

  22. FileRise <= 3.3.0 - Unauthenticated File ReadCVE-2026-25231error311 · CVSS 7.5 · 1.7% likely

    Error311

  23. EKC Tournament Manager WordPress plugin - Path TraversalCVE-2024-9765Lukashuser · CVSS 6.5 · 1.6% likely
  24. Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File DownloadCVE-2021-4463Shenzhen Longjing Technology Co. Ltd. · CVSS 8.7 · 1.5% likely
  25. TinaCMS - Path TraversalCVE-2026-29066@tinacms · CVSS 6.2 · 1.1% likely

    Tinacms

  26. WordPress Download Manager < 3.3.07 - Unauthenticated Data ExposureCVE-2024-13126W3eden · CVSS 4.6 · 0.5% likely

    W3 Eden, Inc.

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in