CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- ibm security verify access docker, security verify access +1 moreIBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary...6.6 Medium
- echobh sharecareAn issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access...8.8 High
- kaseya vsaUnauthenticated Remote Code Execution in Kaseya VSA < v9.5.59.8 Critical
- artware cmsARTWARE CMS - Unrestricted Upload of File9.8 Critical
- fork-cms fork cmsArbitrary file upload in Fork CMS8.8 High
- profilepressProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component9.8 Critical
- profilepressProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component9.8 Critical
- phplistRemote Code Execution vulnerability in phplist 3.5.1. The application does not check any file...9.8 Critical
- machformMachform prior to version 16 is vulnerable to unauthenticated remote code execution due to...8.1 High
- pandorafms pandora fmsPandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the...9.8 Critical
- the eclipse foundation eclipse birt, eclipse business intelligence and reporting tools +1 moreIn Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP...9.8 Critical
- ibosIn IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard...9.8 Critical
- crmebCRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.9.8 Critical
- get-simple getsimplecmsRemote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar...7.2 High
- open source joomla, joomla joomla\! +1 moreJoomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the...9.8 Critical
- autoptimizeAutoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"9.8 Critical
- textpatternTextpattern 4.7.3 contains an aribtrary file load via the file_insert function in include...9.8 Critical
- radykal fancy product designerFancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE9.8 Critical
- themify frameworkElemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework...9.8 Critical
- civicrmIn CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and...8.8 High
- fogprojectFOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).8.8 High
- phpmailer project phpmailer, fedoraproject fedora +1 moreRemote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows8.1 High
- bloofox bloofoxcmsbloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload...9.8 Critical
- zoll defibrillator dashboardZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative...8.8 High
- dext5 editor, raonwiz dext5editor +1 moreRaonwiz DEXT5 Editor File upload and Execution vulnerability7.8 High
- laiketuiLaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php...8.8 High
- std42 elfinderRemote Code Execution (RCE)8.1 High
- openplc scadabrOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated...8.8 High
- vembu bdr suite, offsite dr +1 moreUnauthenticated arbitrary file upload and command execution in Vembu products9.8 Critical
- nagios xiNagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper...7.2 High
- bloofox bloofoxcmsBloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation...8.8 High
- backstage, linuxfoundation \@backstage\/plugin-techdocs +1 moreTechDocs object element script injection6.8 Medium
- backstage, linuxfoundation \@backstage\/techdocs-common +1 moreTechDocs content sanitization bypass6.8 Medium
- wellcmsWellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and...6.5 Medium
- fangfa fdcmsFDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a...9.8 Critical
- external media project media, minnur external media +1 moreExternal Media < 1.0.34 - Authenticated Arbitrary File Upload8.8 High
- synology photo stationUnrestricted upload of file with dangerous type vulnerability in file management component in...8.8 High
- frontiersoftware ichrisFrontier ichris through 5.18 allows users to upload malicious executable files that might later...9.8 Critical
- vfairsvFairs 3.3 is affected by Remote Code Execution. Any user logged in to a vFairs virtual...8.8 High
- bluditA file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on...7.2 High
- admidioVarious9.6 Critical
- emerson x-stream enhanced xefd firmware, x-stream enhanced xegk firmware, x-stream enhanced xegp firmware +1 more +3 moreA vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer....9.8 Critical
- kujirahand konawiki, konawiki2 +1 moreKonaWiki2 versions prior to 2.2.4 allows a remote attacker to upload arbitrary files via...9.8 Critical
- matrix-org matrix-react-sdkFile upload local preview can run embedded scripts after user interaction4.2 Medium
- laobancmsUnrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by...9.8 Critical
- kaswara project kaswara, sayenthemes kaswara modern vc addons +1 moreKaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- articlecms project articlecmsA file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.9.8 Critical
- articlecms project articlecmsFile Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by...9.8 Critical
- uxper goloAn Arbitrary File Upload vulnerability was discovered in the Golo Laravel theme v 1.1.5.9.8 Critical
- zebra fx9500 firmware** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on Zebra (formerly Motorola Solutions)...9.8 Critical
- Show moreLoading…