/uploads/, /logs/, /data/, /backup/

/search, /auth/login

/auth/ldap-login, /admin/tools/ping, /board/free/write, /auth/xml-login, /api/v1/xml-import, /misc/preview

OS command injection in the neo.mjs file-system MCP server (check_syntax / run_playwright_test)

MCP download_file writes fetched bytes to an unvalidated destination path