CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- manager-io managerOpenVAS Manager v2.0.3 allows plugin remote code execution.8.8 High
- dotcmsdotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It...9.8 Critical
- unitedplanet intrexxUnrestricted file upload vulnerability in an unspecified third party tool in United Planet...9.8 Critical
- simplejobscriptcontrollers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated...9.8 Critical
- belkin wemo switch firmwareBelkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary...9.8 Critical
- super file explorer project file explorerAn arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1...8.8 High
- zohocorp manageengine desktop centralUnrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7...9.8 Critical
- gehealthcare apexpro telemetry server firmware, carescape b450 monitor firmware, carescape b650 monitor firmware +6 more +8 moreIn ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior,...9.9 Critical
- devfarm wp gpx mapsWordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via...9.8 Critical
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....7.2 High
- prestashopPrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a...8.8 High
- dimo-crm yellowbox crmAn Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a...8.8 High
- accusoft prizm content connectPrizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability9.8 Critical
- qdpmA remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can...8.8 High
- logaritmo aware callmanagerThe CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012...8.8 High
- oracle revenue management and billing, oracle corporation financial services revenue management and billing +1 moreVulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle...5.4 Medium
- joomla!, joomla joomla\! +1 moreJoomla! 1.5x through 1.5.12: Missing JEXEC Check5.3 Medium
- websitebakerAn Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and...7.2 High
- phpgurukul car rental portalPHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an...7.2 High
- employee records system project records systemuploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code...7.2 High
- gatewaygeomatics mapserverGateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability...8.1 High
- invisioncommunity invision power boardInvision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote...9.8 Critical
- bss continuity cms project continuty cmsBSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated...9.8 Critical
- dedecmsA file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.8.8 High
- thomsonreuters fatcaA file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which...9.9 Critical
- ahsay cloud backup suiteAn insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0...8.8 High
- gilacms gila cmsGila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to...9.1 Critical
- cloudfastpath netcharts serverUnrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers...9.8 Critical
- helpdezkUnrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in...9.8 Critical
- prasathmani tiny file manager, tiny file manager file manager +1 moreRemote Code Execution in Tiny File Manager6.5 Medium
- al-enterprise omnivista 8770An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated...7.2 High
- reviewboardReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review request8.8 High
- sqlite, debian linux, netapp cloud backup +11 more +13 morezipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update...7.5 High
- abcprintf upload-image-with-ajaxDue to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be...9.8 Critical
- plex media serverThe Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote...8.8 High
- joomlaworks k2, verot project verot +1 moreclass.upload.php in verot.net omits .pht from the set of dangerous file extensions9.8 Critical
- contaoUnrestricted file uploads in Contao8.8 High
- siemens sppa-t3000 application serverA vulnerability has been identified in SPPA-T3000 Application Server (All versions). An attacker...7.5 High
- siemens sppa-t3000 ms3000 migration serverA vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An...9.8 Critical
- siemens sppa-t3000 application serverA vulnerability has been identified in SPPA-T3000 Application Server (All versions). An attacker...8.8 High
- intesync solismedIntesync Solismed 3.3sp allows Insecure File Upload.9.8 Critical
- ibm planning analyticsIBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal....6.3 Medium
- nopcommercenopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin...8.8 High
- apache struts, libstruts1.2-java +1 moreUnrestricted Upload of File with Dangerous Type in Apache Struts28.8 High
- adobe stock api integration, prestashop +1 morereset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for...9.8 Critical
- adobe stock api integration, prestashop +1 morereset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API...9.8 Critical
- bmc remedy smart reportingBMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One...6.5 Medium
- joomlaworks k2, verot project verot +1 moreRemote code execution in verot/class.upload.php9.8 Critical
- ibm cloud pak systemIBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files,...9.0 Critical
- titanhq webtitanAn issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it...7.2 High
- Show moreLoading…