CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- zrlogZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could...7.8 High
- zrlogA Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar...9.8 Critical
- concretecms concrete cmsImproper file handling in concrete5/core7.2 High
- hector cabrera wordpress popular posts, wordpress popular posts popular posts +1 moreWordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload8.8 High
- nextcloud talk, kiteworks security-advisories +1 moreXSS in Talk6.4 Medium
- grand vice info webopac7, vice webopac +1 moreGrand Vice info Co. webopac7 - Arbitrary File Upload8.8 High
- bookstackapp bookstack, bookstackapp/bookstack +1 moreUnrestricted Upload of File with Dangerous Type in bookstackapp/bookstack7.6 High
- zohocorp manageengine patch connect plusZoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code...9.8 Critical
- beescmsBEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component ...8.8 High
- servicetonicArbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0...9.8 Critical
- hitachi vantara pentahoUploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify...2.7 Low
- hitachi vantara pentaho, vantara pentaho business intelligence server +1 moreAn issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence...8.8 High
- engineers online portal project online portalA file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via...9.8 Critical
- ed01-cms project ed01-cmsAn arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows...9.8 Critical
- doyocms project doyocmsArbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to...9.8 Critical
- s-cartS-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the...8.8 High
- learndash, stellarwp learndash lms +1 moreLearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload7.5 High
- janobe online reviewer systemRemote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by...9.8 Critical
- oretnom23 budget and expense tracker systemRemote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker...8.8 High
- oretnom23 online food ordering systemRemote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0...9.8 Critical
- church management system project management systemRemote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0...9.8 Critical
- e-negosyo system project systemA Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in ...7.2 High
- monstraA remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action...9.8 Critical
- mara cms project cmsA remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of...9.8 Critical
- flatcore flatcore-cms, flatcore/flatcore-cms +1 moreUnrestricted Upload of File with Dangerous Type in flatcore/flatcore-cms8.0 High
- bookstackapp bookstack, bookstackapp/bookstack +1 moreUnrestricted Upload of File with Dangerous Type in bookstackapp/bookstack5.4 Medium
- customer relationship management system project relationship management systemA file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0...8.8 High
- online student admission system project student admission systemOnline Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low...8.8 High
- nagios xiAn issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an...7.2 High
- nextcloud server, kiteworks security-advisories +1 moreFile Traversal affecting SVG files on Nextcloud Server8.8 High
- nextcloud contacts, kiteworks security-advisories +1 moreXSS in Contacts6.4 Medium
- air sender project senderTran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the...8.8 High
- madeportable playablePortable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in...7.8 High
- salesagility suitecrmSuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name...8.8 High
- showdocShowdoc File Upload Vulnerability9.8 Critical
- auvesy versiondogAUVESY Versiondog9.1 Critical
- catch themes demo import themes demo import, catchplugins catch themes demo import +1 moreCatch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload7.2 High
- firefly-iii firefly-iii/firefly-iii, firefly iii +1 moreUnrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii6.3 Medium
- inhand networks ir615 router, inhandnetworks ir615 firmware +1 moreInHand Networks IR615 Router9.1 Critical
- brizy brizy-page builder, brizy.io brizy - page builder +1 moreBrizy <= 2.3.11 Authenticated Unrestricted File Upload and Path Traversal8.8 High
- embedthis goaheadAn issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form...9.8 Critical
- zohocorp manageengine admanager plusManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution...8.8 High
- zohocorp manageengine admanager plusManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution...8.8 High
- draytek vigorconnectAn arbitrary file upload and directory traversal vulnerability exists in the file upload...9.8 Critical
- php-fusion phpfusionPHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager...7.2 High
- php-fusion phpfusionPHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will...7.2 High
- accesspress themes accesspress-basic, accesspress-lite, accesspress-mag +41 more +43 moreAccessPress Themes - Authenticated Malicious File Upload8.8 High
- webtareas project webtareaswebTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially...8.8 High
- tad tadtoolsTad TadTools - Arbitrary File Upload9.8 Critical
- ibm sterling file gateway, sterling b2b integrator +1 moreIBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload...6.5 Medium
- Show moreLoading…