CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft exchange server, exchange server 2013 cumulative update 23, exchange server 2016 cumulative update 19 +3 more +5 moreMicrosoft Exchange Server Security Feature Bypass Vulnerability6.6 Medium
- sap netweaver process integration, sap se process integration (integration builder framework) +1 moreThe Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7...4.9 Medium
- invoiceplaneIn InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.5.3 Medium
- nsa emissaryU.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload...8.8 High
- emlogemlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of...9.8 Critical
- projectworlds online book store project in phpArbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to...9.8 Critical
- college publisher import project publisher import, unknown college publisher import +1 moreCollege Publisher Import <= 0.1 - Arbitrary File Upload to RCE7.2 High
- classyfrieds project classyfriedsClassyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE8.8 High
- unknown event bannerEvent Banner <= 1.3 - Arbitrary File Upload to RCE7.2 High
- business directory team directory plugin – easy listing directories for wordpress, strategy11team business directory plugin – easy listing directories for wordpress, strategy11 business directory plugin - easy listing directories +2 moreBusiness Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE7.2 High
- imagements project imagementsImagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE9.8 Critical
- djangoproject django, debian linux, fedoraproject fedora +2 morePath Traversal in Django7.5 High
- guojusoft jeecgUnrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary...9.8 Critical
- laravel frameworkWithdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.9.8 Critical
- uniview isc2500-s firmwareAn issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker...9.8 Critical
- aivahthemes business hours proBusiness Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE9.8 Critical
- textpatternTextpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded...6.5 Medium
- orchardproject orchardAn issue was discovered in Orchard before 1.10. A broken access control issue in Orchard...9.8 Critical
- eaton intelligent power manager (ipm), intelligent power manager, intelligent power manager virtual appliance +1 more +3 moreArbitrary File upload8.0 High
- hassantafreshi easy form builder, easy-form-builder-by-bitware project easy-form-builder-by-bitware +1 moreEasy Form Builder <= 1.0 - Authenticated Arbitrary File Upload8.8 High
- n5 upload form project upload form, unknown n5 upload form +1 moreN5 Upload Form <= 1.0 - Unauthenticated Arbitrary File Upload to RCE9.8 Critical
- unknown wp-curriculo vitae freeWP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE9.8 Critical
- thrive themes focusblog by thrive themes, ignition by thrive themes, luxe by thrive themes +16 more +18 moreAll Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion9.1 Critical
- sonicwall email security, email security appliance 3300 firmware, email security appliance 4300 firmware +8 more +10 moreSonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post...7.2 High
- rangerstudio directusDirectus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file...8.8 High
- deltaflow project deltaflow, vangene deltaflow e-platform +1 moreVangene deltaFlow E-platform - Arbitrary File Upload9.8 Critical
- ocproducts composrComposr 10.0.36 allows upload and execution of PHP files.9.8 Critical
- unknown woocommerce help scout, woocommerce help scout +1 moreWooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE9.8 Critical
- unknown woocommerce upload filesWooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload9.8 Critical
- expresstech responsive menu, responsive menu pro, responsive menu – create mobile-friendly menu +2 moreResponsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload8.8 High
- backup-guard backup guard, unknown wordpress backup and migrate plugin – backup guard +1 moreBackup Guard < 1.6.0 - Authenticated Arbitrary File Upload7.2 High
- emlogVulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module.9.8 Critical
- f5 big-ip access policy manager, big-ip advanced firewall manager, big-ip advanced web application firewall +11 more +13 moreOn versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before...4.3 Medium
- simple college project collegeSimple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax...7.2 High
- insma wifi mini spy 1080p hd security ip camera firmwareAn issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local...6.2 Medium
- netgear prosafe network management systemThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...9.8 Critical
- nokia netactAn issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web...6.5 Medium
- typo3, typo3 typo3.cms +1 moreUnrestricted File Upload in Form Framework8.6 High
- typo3, typo3 typo3.cms +1 moreBroken Access Control in Form Framework8.3 High
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack5.4 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack5.3 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack6.1 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack6.1 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attack5.3 Medium
- unknown modern events calendar liteModern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE7.2 High
- blubrry powerpressPowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE7.2 High
- online ordering system project ordering systemOnline Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST...9.8 Critical
- shopxoShopXO RCE Vulnerability9.8 Critical
- myvestacp myvesta, vestacp vesta control panel +1 moreweb/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta...8.8 High
- secomea gatemanager, gatemanager 8250 firmware +1 moreAdd integrity check of GateManager firmware8.4 High
- Show moreLoading…