CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- dungeon crawl stone soup project crawl stone soupDungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute...9.8 Critical
- advantech webaccess/nms, webaccess\/nms +1 moreMultiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions...9.8 Critical
- primekey ejbcaAn issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command...7.2 High
- cipplanner cipaceAn issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote...9.8 Critical
- projectworlds official car rental systemAn issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user...7.2 High
- testlinkAn unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote...8.8 High
- microstrategy webThe Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator...7.2 High
- lifterlmsLifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to...9.8 Critical
- s9y serendipitySerendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the...9.8 Critical
- frozennode laravel-administratorFrozenNode Laravel-Administrator unrestricted file upload7.2 High
- acyba acymailingAcyba AcyMailing before 6.9.2 mishandles file uploads by admins.7.2 High
- horde groupware, groupware webmail edition, debian linux +1 more +3 moreThis vulnerability allows remote attackers to create arbitrary files on affected installations of...4.3 Medium
- artica pandora fmsIn Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a ...7.2 High
- artica pandora fmsArtica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an...7.2 High
- ez publish-kernel, publish-legacy +1 moreeZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type9.8 Critical
- cmsmadesimple cms made simpleThe Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file...7.8 High
- netsas enigma network management solutionAn unrestricted file upload vulnerability exists in user and system file upload functions in...8.8 High
- logicaldocLogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command...9.8 Critical
- trendmicro apex one, officescan, trend micro apex one and officescan +1 more +3 moreTrend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could...9.8 Critical
- paessler prtg network monitorA Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and...7.2 High
- umbraco cmsUnrestricted Upload of File with Dangerous Type in Umbraco CMS6.5 Medium
- umbraco cmsUmbraco CMS Authenticated File Upload8.8 High
- artica pandora fmsindex.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows...7.2 High
- atutor acontentAn issue was discovered in AContent through 1.4. It allows the user to run commands on the server...8.8 High
- devome grrAn issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads.7.2 High
- chadhaajay phpkbadmin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote...7.2 High
- lexmark markvision enterpriseLexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary...10.0 Critical
- widgetfactorylimited jceJCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an...8.8 High
- joobi jnewsJNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as...8.8 High
- bookstackapp bookstackRemote Code Execution Through Image Uploads in BookStack7.9 High
- phpgurukul online book storeAn unauthenticated file upload vulnerability has been identified in admin_add.php in PHPGurukul...9.8 Critical
- phpgurukul job portalAn unauthenticated file upload vulnerability has been identified in admin/gallery.php in...9.8 Critical
- whmcssmarters web tv playerIPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by...9.8 Critical
- fleetco fleet maintenance managementFleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php"...8.8 High
- artica pandora fmsIn Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file...7.2 High
- jaba xpressAn issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary...8.8 High
- kunenaKunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can...9.8 Critical
- dnnsoftware dotnetnukeDNN File Upload Vulnerability6.5 Medium
- avira anti-malware sdk, antivirus for endpoint, antivirus for small business +5 more +7 moreAvira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This...5.5 Medium
- o-dyn collabtive, canonical ubuntu linux, debian linux +2 moreMultiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser...8.8 High
- digi connectport lts 32 mei bios, connectport lts 32 mei firmware +1 moreDigi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios...4.9 Medium
- joomla! tinybrowser plugin, tiny tinybrowser +1 moreTinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.9.8 Critical
- joomla! tiny browser included with tinymce 3.0, tiny tinybrowser +1 moreTiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP...9.8 Critical
- imagely nextgen galleryNextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload9.8 Critical
- yabbYaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability9.8 Critical
- polarbear cms project cmsA PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a...9.8 Critical
- samsung prismview player 11, prismview system 9 +1 moreThe HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote...9.8 Critical
- creative-solutions creative contact form, jquery file upload project file upload +1 morejQuery File Upload Plugin Unrestricted file upload vulnerability9.8 Critical
- vtiger crmvTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability8.8 High
- vtiger crmUnrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in...8.8 High
- Show moreLoading…