Which two regular user PATH assignments expose the user to a Trojan horse attack?

Which two regular user PATH assignments expose the user to a Trojan horse attack? (Choose two.)

A.
PATH=/usr/bin:/bin

B.
PATH=/usr/bin:/sbin:/usr/sbin

C.
PATH=/usr/bin:/sbin:/usr/sbin:

D.
PATH=.:/usr/bin:/sbin:/usr/sbin