Skip to content
BackEsc
Sign in

CWE-73 · weakness in File and Path Handling

External Control of File Name or Path

646 CVEs · 5 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
5
check available
13
likely to be exploited
15

Every one of the 646 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Internet Shortcut Files Remote Code Execution VulnerabilityCVE-2025-33053Microsoft · CVSS 8.8 · 87% likely

    Microsoft

  2. NTLM Hash Disclosure Spoofing VulnerabilityCVE-2024-43451Microsoft · CVSS 6.5 · 84% likely

    Microsoft

  3. NTLM Hash Disclosure Spoofing VulnerabilityCVE-2025-24054Microsoft · CVSS 6.5 · 62% likely

    Microsoft

  4. PAN-OS: Authenticated File Read Vulnerability in the Management Web InterfaceCVE-2025-0111Palo Alto Networks · CVSS 7.1 · 2.0% likely

    Palo Alto Networks

  5. Plex Media Server < 1.43.3.10861 - Arbitrary File Write to Code ExecutionCVE-2026-96656Plex · CVSS 7.2 · 1.8% likelycovered by CyberSIXT

    Plex10 articles4 articles this week: Plex2Shell Flaws Exploited to Hack Internet Facing NAS Devices

  6. Fortinet FortiNAC - Arbitrary File WriteCVE-2022-39952Fortinet · CVSS 9.8 · 100% likely

    Fortinet

  7. SPIP BigUp Plugin - Remote Code ExecutionCVE-2024-8517SPIP · CVSS 9.8 · 95% likely

    SPIP

  8. Media Library Assistant < 3.09 - Remote Code Execution/Local File InclusionCVE-2023-4634dglingren · CVSS 9.8 · 86% likely

    Dglingren

  9. Kibana - Local File InclusionCVE-2018-17246Elastic · 84% likely

    Elastic

  10. CAREL Boss Mini <= 1.4.0 - Local File InclusionCVE-2023-3643Boss Mini · CVSS 7.3 · 75% likely
  11. Piano LED Visualizer 1.3 - Local File InclusionCVE-2022-24900onlaj · CVSS 9.9 · 8.4% likely
  12. Moodle - Cross-Site Scripting/Remote Code ExecutionCVE-2023-30943CVSS 6.5 · 6.8% likely
  13. Flowise - Path TraversalCVE-2025-71334Flowise · CVSS 9.8 · 4.4% likely

    Flowise

  14. Devika - Local File InclusionCVE-2024-5334stitionai · CVSS 7.5 · 2.1% likely

    Stitionai

  15. Mockoon < 9.2.0 - Path TraversalCVE-2025-59049mockoon · CVSS 7.5 · 1.8% likely
  16. Flowise - Path TraversalCVE-2025-71324Flowise · CVSS 7.5 · 1.6% likely

    Flowise

  17. HSC MailInspector - Local File InclusionCVE-2026-29962Hsclabs · CVSS 7.5 · 1.5% likely
  18. Directus - Unauthenticated File ModificationCVE-2025-55746directus · CVSS 9.3 · 1.5% likely

    Directus

  19. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication…CVE-2021-27250D-Link · CVSS 6.5 · 67% likely

    D-Link

  20. XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsCVE-2021-21343x-stream · CVSS 5.3 · 47% likely

    X-Stream

  21. NTLM Hash Disclosure Spoofing VulnerabilityCVE-2025-21377Microsoft · CVSS 6.5 · 40% likely

    Microsoft

  22. Windows Compressed Folder Tampering VulnerabilityCVE-2024-26185Microsoft · CVSS 6.5 · 30% likely

    Microsoft

  23. External Control of File Name or Path in unilogies/bumsysCVE-2023-2554unilogies · CVSS 7.2 · 29% likely

    Unilogies

  24. GLPI allows remote code execution through the plugin loaderCVE-2024-37149glpi-project · CVSS 7.2 · 21% likely

    GLPI

  25. SourceCodester Clinic Queuing System GET Parameter index.php file inclusionCVE-2024-0265SourceCodester · CVSS 6.3 · 21% likely

    SourceCodester

  26. CVECVE-2024-0087nvidia · CVSS 9 · 20% likely

    NVIDIA

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in