CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- pluck-cms pluckA file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin...7.2 High
- alumni management system project management systemA Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An...7.2 High
- sap se netweaver as java, sap netweaver application server java +1 moreProcess Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an...6.5 Medium
- sap disclosure management, sap se disclosure management. +1 moreSAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload...5.4 Medium
- txjia imcatimcat 5.2 allows an authenticated file upload and consequently remote code execution via the...7.2 High
- getkirby kirby, panel +1 morePHP Phar archives could be uploaded and executed in Kirby6.8 Medium
- incomcms project incomcmsIncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This...9.8 Critical
- openclinic project openclinicOpenClinic version 0.8.2 is affected by a medical/test_new.php insecure file upload vulnerability...7.2 High
- outsystemsAn issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An...7.2 High
- ucms project ucmsFile upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this...9.8 Critical
- schneider-electric webreportsA CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure...8.8 High
- drupal, drupal core, fedoraproject fedora +2 moreDrupal core Unrestricted Upload of File with Dangerous Type8.8 High
- lemocmsapp\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload...7.3 High
- aviatrix controllerAn issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions...9.8 Critical
- online library management system project library management systemAn Arbitrary File Upload in the Upload Image component in SourceCodester Online Library...9.8 Critical
- phpgurukul tourism management systemAn Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the...8.8 High
- online clothing store project clothing storeSourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image...9.8 Critical
- artworks gallery in php\, css\, javascript\, and mysql project gallery in php\, css\, javascript\, and mysqlThe edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows...8.8 High
- artworks gallery in php\, css\, javascript\, and mysql project gallery in php\, css\, javascript\, and mysqlThe add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows...8.8 High
- horizontcms project horizontcmsAn unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote...8.8 High
- gilacms gila cmsIn Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the...7.2 High
- ivanti endpoint managerAn unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1...9.9 Critical
- sapplica sentrifugoIn Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab. This "Upload Images"...8.8 High
- sapplica sentrifugoIn Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab....8.8 High
- flexdotnetcms project flexdotnetcmsAn unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote...8.8 High
- sap se netweaver as java, sap netweaver application server java +1 moreSAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is...9.1 Critical
- microweberAn unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account...9.8 Critical
- magento, adobe magento commerce +1 moreArbitrary code execution via file import functionality9.1 Critical
- salesagility suitecrmSuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File...8.8 High
- horizontcms project horizontcmsAn unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated...8.8 High
- basercmsRemote Code Execution in baserCMS7.2 High
- ibm i2 ibaseIBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when...7.7 High
- intel bmc firmware, nvidia dgx servers +1 moreNVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a...9.8 Critical
- ivanti connect secure, pulse connect secure +1 moreA vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an...7.2 High
- car rental management system project rental management systemAn Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management...9.8 Critical
- ucms project ucmsAn arbitrary command execution vulnerability exists in the fopen() function of file writes of...9.8 Critical
- cisco adaptive security appliance, adaptive security appliance software, adaptive security appliance (asa) software +1 more +3 moreCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services File Upload Denial of Service Vulnerability8.6 High
- sagedpw sage dpwAn issue was discovered in Sage DPW 2020_06_x before 2020_06_002. It allows unauthenticated users...6.1 Medium
- cuppacmsThe file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload...8.8 High
- mozilla firefoxWhen processing a MAR update file, after the signature has been validated, an invalid name length...8.8 High
- rainbowfishsoftware pacsone serverRainbowFish PacsOne Server 6.8.4 has Incorrect Access Control.8.8 High
- re-desk re\Re:Desk 2.3 allows insecure file upload.7.5 High
- niushopNiushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the...9.8 Critical
- pluck-cms pluckAn issue was discovered in Pluck CMS v4.7.11. There is a file upload vulnerability that can cause...8.8 High
- seat reservation system project reservation systemSeat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability...9.8 Critical
- observiumAn issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is...8.8 High
- observiumAn issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is...8.8 High
- observiumAn issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is...8.8 High
- observiumAn issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is...8.8 High
- observiumAn issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is...8.8 High
- Show moreLoading…