CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which...9.8 Critical
- artica integria imsIntegria IMS Remote Code Execution9.8 Critical
- ecoa ecs router controller ecs (flash), ecs router controller-ecs firmware, graphic control software +6 more +8 moreECOA BAS controller - Path Traversal-19.8 Critical
- huawei fusioncomputeThere is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0....7.5 High
- monstra cmsAn issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via...6.5 Medium
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload...9.8 Critical
- zohocorp manageengine admanager plusZoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to...9.8 Critical
- frogcms project frogcmsPrivilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute...9.8 Critical
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A...9.8 Critical
- zohocorp manageengine admanager plusManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.8.8 High
- cobbler project cobblerCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.7.5 High
- simple schools staff directory project schools staff directory, unknown simple schools staff directory +1 moreSimple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload7.2 High
- jizhicmsAn arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary...7.2 High
- rgcms project rgcmsAn arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code...7.2 High
- feehi feehicmsArbitrary Code Execution in feehi/cms9.8 Critical
- sap business oneSAP Business One, version - 10.0, allows an attacker with business authorization to upload any...9.9 Critical
- drupal core, drupal +1 moreUnrestricted Upload of File with Dangerous Type in Drupal core9.8 Critical
- zenitel alphacom xe audio serverThe web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not...8.8 High
- kooboo cmsKooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It is possible to upload any file...9.8 Critical
- kooboo cmsIn Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and...9.8 Critical
- sap netweaver, sap se netweaver (visual composer 7.0 rt) +1 moreSAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an...9.9 Critical
- kitesky kitecmsAn arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows...7.8 High
- zkea zkeacmsAn arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers...8.8 High
- unknown wordpress simple ecommerce shopping cart plugin- sell products through paypal, simple-e-commerce-shopping-cart project simple-e-commerce-shopping-cart +1 moreSimple eCommerce <= 2.2.5 - Arbitrary File Upload8.8 High
- ingenesis shoppShopp eCommerce <= 1.4 - Unauthenticated Arbitrary File Upload9.8 Critical
- email artillery project artillery, unknown email artillery (mass email) +1 moreEmail Artillery <= 4.1 - Arbitrary File Upload6.8 Medium
- aviatrix controllerAn issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a...9.8 Critical
- dswjcms project dswjcmsAn issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute...9.8 Critical
- showdocUnrestricted File Upload in ShowDoc v2.9.59.8 Critical
- dotcmsUnrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote...9.8 Critical
- simple water refilling station management system project water refilling station management systemRemote Code Execution can occur in Simple Water Refilling Station Management System 1.0 via the...8.8 High
- sketchSketch before 75 mishandles external library feeds.9.8 Critical
- pureftpd pure-ftpdIn Pure-FTPd 1.0.49, an incorrect max_filesize quota mechanism in the server allows attackers to...7.5 High
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution9.1 Critical
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce Improper Input Validation Could Lead To Remote Code Execution9.1 Critical
- ibm openpages with watsonIBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that...8.8 High
- kramerav viawareKRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because...9.8 Critical
- deltaww diaenergieDelta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may...9.8 Critical
- zohocorp manageengine log360Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote...9.8 Critical
- Show moreLoading…