CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- observiumAn issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is...8.8 High
- gogogate ismartgate pro firmwareismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to...9.8 Critical
- gogogate ismartgate pro firmwareismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to...7.5 High
- cisco unified contact center express, unified ip interactive voice response +1 moreCisco Unified Contact Center Express Privilege Escalation Vulnerability7.2 High
- simple library management system project library management systemSourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books...7.8 High
- ozeki ng sms gatewayOzeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new...8.8 High
- liferay portal, digital experience platform +1 moreUnrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP6.5 Medium
- ibm data risk managerIBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload...8.8 High
- typesettercms typesetter** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP...7.2 High
- brassica soy cms, inunosinsi soycms +1 moreRemote Code Execution in SOY CMS6.8 Medium
- webtareas project webtareaswebTareas through 2.1 allows upload of the dangerous .exe and .shtml file types.7.5 High
- rad secflow-1v firmwareA vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could...6.1 Medium
- online course registration project course registrationA File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote...9.8 Critical
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an...8.0 High
- vtenextA file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files...8.8 High
- pligg project pliggPligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template...7.2 High
- online bike rental project bike rentalAn Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0...9.1 Critical
- projectworlds car rental projectArbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental...9.8 Critical
- sap se business objects business intelligence platform (web intelligence html interface), sap businessobjects business intelligence platform +1 moreSAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an...4.6 Medium
- filemanagerpro file manager, wordpress file manager plugin +1 moreThe File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to...10.0 Critical
- concretecms concrete cmsConcrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such...7.2 High
- zohocorp manageengine applications managerZoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to...7.2 High
- maracmsAn arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must...7.2 High
- autoptimizeThe ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file...7.2 High
- dolibarrDolibarr Unrestricted Upload of File with Dangerous Type8.8 High
- librehealth ehrinterface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated...8.8 High
- projectworlds travel management systemInsecure File Permissions and Arbitrary File Upload in the upload pic function in...9.8 Critical
- projectworlds house rental and property listing projectFile Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload...9.8 Critical
- online bike rental project bike rentalAn Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated...7.2 High
- gmapfpIn Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function...7.5 High
- marvell qconvergeconsoleThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- gvectors wpdiscuzA Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4...10.0 Critical
- sysax multi serverWhen uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="...6.5 Medium
- rapidscada rapid scadaRapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in...7.8 High
- pnotes.net project pnotes.netA File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker...7.8 High
- cmsmadesimple cms made simpleCMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does...7.8 High
- mcafee data loss prevention, dlp epo extension +1 moreDLP ePO extension - Unrestricted Upload of File with Dangerous Type5.4 Medium
- sap se netweaver (knowledge management), sap netweaver knowledge management +1 moreSAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an...7.3 High
- mozilla firefox esrGiven an installed malicious file picker application, an attacker was able to steal and upload...5.5 Medium
- flatcoreflatCore before 1.5.7 allows upload and execution of a .php file by an admin.7.2 High
- teltonika-networks trb245 firmwareImproper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated...7.5 High
- teltonika-networks trb245 firmwareImproper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated...7.5 High
- freemedsoftware openclinic gaOpenClinic GA8.8 High
- concretecms concrete cmsUnrestricted Uploads in Concrete57.2 High
- silverstripe mimevalidator, recipe +1 moreSilverstripe CMS malicious file upload enables script execution8.8 High
- icewarp mail serverIceWarp Email Server 12.3.0.1 allows remote attackers to upload JavaScript files that are...8.8 High
- icewarp mail serverIceWarp Email Server 12.3.0.1 allows remote attackers to upload files and consume disk space.6.5 Medium
- seczetta neprofileA remote code execution vulnerability was identified in SecZetta NEProfile 3.3.11. Authenticated...8.8 High
- microsoft bond, bond 9.0.1 +1 moreInfinite loop in .Net Bond7.5 High
- atlassian jira, jira server, jira data center +1 more +3 moreThe avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows...6.5 Medium
- Show moreLoading…