CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- dataease DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload 6.9 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- esaia interactive real estate – floor plan & building visualizer Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json 8.8 High
- payever checkout – composable payment gateway payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 9.8 Critical
- geonode GeoNode: Unrestricted File Upload 5.5 Medium
- gen digital avast antivirus, avast one, avast premium security, avast ultimate, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 more Avast sandbox escape via arbitrary file write in virtualized environment No score
- jiangweifang live2dwebcanvas Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter 8.1 High
- unknown wp libre form WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload 10.0 Critical
- campcodes complete advance loan management system Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload 6.9 Medium
- yealink plug-in softwares In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability... 9.0 Critical
- unknown wpvivid — backup, migration & staging WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files 6.7 Medium
- webkul bagisto Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload 2.1 Low
- volmarg personal-management-system Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/ 8.6 High
- buddyboss app BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint 8.8 High
- acf extended advanced custom fields: extended pro Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type 9.8 Critical
- joomlaboat.com custom tables extension for joomla Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 9.5 Critical
- dj-extensions.com dj-classifieds extension for joomla Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 9.4 Critical
- smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal 8.8 High
- wpazleen simpleform – form maker to chat apps with quiz, poll and multi lead notifications SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data 9.8 Critical
- wedevs project manager – ai powered project management, task management, kanban board & time tracker Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection 9.8 Critical
- 37954679 cak-filemanagement-system 37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload 6.9 Medium
- smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload 7.5 High
- themefusion avada | website builder for wordpress & woocommerce Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field 8.1 High
- socfortress copilot SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) 10.0 Critical
- arketeam bdf, protectelmaj +1 more Arbitrary File Upload in Protectel 5.3 Medium
- docat-org docat Docat has Arbitrary File Upload exists in Upload API 9.1 Critical
- progress software ws ftp server Virtual Folder Path Confinement Bypass in Progress WS_FTP Server 9.1 Critical
- progress software ws ftp server Host Administrator Path Containment Bypass in Progress WS_FTP Server 9.1 Critical
- unknown chat ai with dispatcher Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload 9.8 Critical
- apereo foundation openequella Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin 4.8 Medium
- hcl software bigfix aex HCL BigFix AEX is affected by multiple security vulnerabilities. 8.6 High
- kleor contact manager Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass 9.8 Critical
- melograno the innovative form builder – ivyforms The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload 8.8 High
- unknown checkout files upload for woocommerce Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload 9.8 Critical
- cservit affiliate-toolkit – multi-network affiliate & amazon product display affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter 7.5 High
- notfound pie register premium, pie register premium +1 more Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler 9.8 Critical
- thexerteproject xerteonlinetoolkits Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import 8.6 High
- c97net cart engine, kemana directory, qengine cms +2 more C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields 8.7 High
- oretnom23 php-travel-agency-system oretnom23 php-travel-agency-system employee_insert.php unrestricted upload 6.9 Medium
- pumukit Unrestricted Upload of File in PuMuKIT application 8.8 High
- sourcecodester online food ordering system SourceCodester Online Food Ordering System add_food.php unrestricted upload 5.1 Medium
- No product listed An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicl… 9.9 Critical
- oray pugongying x5 pro Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload 8.6 High
- No product listed GouGuOA Api.php chunkUpload unrestricted upload 5.3 Medium
- collabora kodexplorer KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload 5.3 Medium
- prasathmani tinyfilemanager prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload 5.3 Medium
- baserproject basercms baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload 8.5 High
- averta depicter — popup & slider builder Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload 5.4 Medium
- part-db part-db-server Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer 5.4 Medium
- part-db part-db-server Part-DB: Authenticated RCE via .phar attachment upload served from public/media 9.6 Critical
- Show olderLoading…