recorded together · two weakness classes
File and Path Handling and Cross-site Scripting
72 CVEs
72 CVEs name a weakness of both File and Path Handling and Cross-site Scripting, fewer than chance alone would give (about 90). The pairing most often behind it is CWE-434 (Unrestricted File Upload) with CWE-79 (Cross-site Scripting), in 54 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 72
- Chance alone would give
- about 90
- So they are recorded together
- less often than chance (0.8×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial from 25 CVEs and 1.15 times chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- check available
- 1
Every one of the 72 is a mark on the map. Named now: 1 to 26, most at risk first.
- Kentico Xperience CMS - Unauthenticated Stored XSS
- An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-up…
- A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS pay…
- WordPress Download Manager <= 3.1.24 Authenticated Directory Traversal
- Stored XSS and path traversal in LDAPAccountManager/lam
- Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius
- XSS in Talk
- ViewVC's standalone server exposes arbitrary server filesystem content
- MaxBoard XSS and File Upload Vulnerability
- Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
- Cross-site scripting in Progress MarkLogic Server Query Console
- Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads
- Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScrip…
- Visual Studio Code Security Feature Bypass Vulnerability
- An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file.
- Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager
- NocoDB Allows Preview of File with Dangerous Content
- HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload
- sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload
- FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
- XSS in Contacts
- File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG file…
- Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component
- Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes
- A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel.
- Improper input leads to DoS
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.