CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- simple chatbot application project chatbot applicationA Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1...9.8 Critical
- dolphinphpDolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php...8.8 High
- jpressjpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The...7.2 High
- jpressjpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController...7.2 High
- mingsoft mcmsMingsoft MCMS vulnerable to Remote Code Execution via file upload.9.8 Critical
- f5 big-ip advanced web application firewall, big-ip application acceleration manager +1 moreOn BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before...4.3 Medium
- forestblog project forestblogIn ForestBlog, as of 2021-12-28, File upload can bypass verification.9.8 Critical
- kea-hotel-erp project kea-hotel-erpIn MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution...8.8 High
- mingsoft mcmsArbitrary file upload in Mingsoft MCMS9.8 Critical
- mingsoft mcmsArbitrary File Upload in Mingsoft MCMS9.8 Critical
- jpressjpress v4.2.0 allows users to register an account by default. With the account, user can upload...8.8 High
- free school management software project school management softwareAn unrestricted file upload vulnerability exists in Sourcecodester Free school management...9.8 Critical
- pimcore, pimcore pimcore/pimcore +1 moreUnrestricted Upload of File with Dangerous Type in pimcore/pimcore6.6 Medium
- leostream connection brokerLeostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.7.2 High
- softvibe sarabanSoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows...9.8 Critical
- crater-invoice crater-invoice/crater, craterapp crater +1 moreUnrestricted Upload of File with Dangerous Type in crater-invoice/crater7.2 High
- owncloud files antivirusThe files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by...8.8 High
- commvault commcellThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- commvault commcellThis vulnerability allows remote attackers to execute arbitrary code on affected installations of...8.8 High
- printable staff id card creator system project staff id card creator systemIn Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database...9.8 Critical
- zohocorp log360, manageengine cloud security plus +1 moreZoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the...8.8 High
- crater-invoice crater-invoice/crater, craterapp crater +1 moreUnrestricted Upload of File with Dangerous Type in crater-invoice/crater8.8 High
- sysaidAn unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows...8.8 High
- vehicle service management system project service management systemAn Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management...7.2 High
- vehicle service management system project service management systemAn Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management...4.8 Medium
- vehicle service management system project service management systemSourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker...8.8 High
- metersphereAn arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users...9.8 Critical
- quest kace desktop authorityAn issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles...9.8 Critical
- spipSPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability,...8.8 High
- unknown directorist – business directory plugin, wpwax directorist +1 moreDirectorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload7.5 High
- solarwinds orion platformUnrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.66.8 Medium
- chain sea information integration co., ltd ai chatbot system, chinasea qb smart service robot +1 moreChain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload9.8 Critical
- 4mosan gcb doctor4MOSAn GCB Doctor - Unrestricted Upload of File9.8 Critical
- unisharp laravel-filemanagerUnrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager6.7 Medium
- opencatsOpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an...9.8 Critical
- socomec remote view pro firmwareAn issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An...8.8 High
- patrowl patrowlmanagerUnrestricted Upload of Files in Patrowl7.4 High
- emlogA Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.9.8 Critical
- fastadminfastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution...9.8 Critical
- pluck-cms pluckIn Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading...8.1 High
- dreamreport remote connectorA privilege escalation vulnerability exists in the Remote Server functionality of Dream Report...8.8 High
- cybonet mail secure, pineapp - mail secure +1 moreCybonet - PineApp8.8 High
- fatpipe ipvpn, mpvpn, warp +4 more +6 moreArbitrary file upload vulnerability in FatPipe software9.8 Critical
- ivanti avalancheAn exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an...8.1 High
- ivanti avalancheAn unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an...8.8 High
- distributed data systems webhmi, webhmi firmware +1 moreDistributed Data Systems WebHM10.0 Critical
- tiny pluploadArbitrary File Upload4.2 Medium
- zblogcn z-blogphpAn arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute...7.8 High
- zohocorp manageengine m365 manager plusZoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.9.8 Critical
- business-dna solutions gmbh topeaseMissing Upload Filter in TopEase7.3 High
- Show moreLoading…