CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- cuppacmsThe component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to...9.8 Critical
- showdoc, star7th star7th/showdoc +1 moreFile Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc8.2 High
- showdoc, star7th star7th/showdoc +1 moreUnrestricted Upload of File with Dangerous Type in star7th/showdoc6.5 Medium
- showdoc, star7th star7th/showdoc +1 moreStored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc9.0 Critical
- syliusBasic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius6.1 Medium
- showdoc, star7th star7th/showdoc +1 moreStored XSS viva .webma file upload in star7th/showdoc9.0 Critical
- tribalsystems zenarioUnrestricted Upload of File with Dangerous Type in Zenario CMS7.2 High
- showdoc, star7th star7th/showdoc +1 moreStored XSS viva .properties file upload in star7th/showdoc9.0 Critical
- arni cinco wpcargo track & trace, wptaskforce wpcargo track \& trace +1 moreWPCargo < 6.9.0 - Unauthenticated RCE9.8 Critical
- smartertools smartertrackFile upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.140109.1 Critical
- microweber, microweber microweber/microweber +1 moreFile upload filter bypass leading to stored XSS in microweber/microweber8.0 High
- microweber, microweber microweber/microweber +1 moreAbusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber7.2 High
- microweber, microweber microweber/microweber +1 moreUnrestricted Upload of File with Dangerous Type in microweber/microweber4.8 Medium
- croogoUnrestricted Upload of File with Dangerous Type in Croogo8.8 High
- sentcmssentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized...9.8 Critical
- sentcmssentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized...9.8 Critical
- quicklertAn arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 ...8.8 High
- catch themes demo import themes demo import, catchplugins catch themes demo import +1 moreCatch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution7.2 High
- iptanus wordpress file upload, unknown wordpress-file-upload-pro, iptanus wordpress file upload pro +2 moreWordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG5.4 Medium
- unknown all-in-one wp migration, servmask one-stop wp migration +1 moreAll-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE7.2 High
- abantecartAbantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by...7.2 High
- home owners collection management system project owners collection management systemA remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user...7.8 High
- home owners collection management system project owners collection management systemHome Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload...9.8 Critical
- extensis portfolioAn unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis...8.8 High
- extensis portfolioExtensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload...8.8 High
- extensis portfolioAn unrestricted file upload vulnerability in the FileTransferServlet component of Extensis...8.8 High
- extensis portfolioExtensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload...8.8 High
- max-3000 maxsite cmsA Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows...9.8 Critical
- cmsmadesimple cms made simpleCMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability...7.2 High
- modx revolutionUnrestricted Upload of File with Dangerous Type in MODX Revolution7.2 High
- xerteAn Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in...8.8 High
- watchguard firewareWatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged...8.8 High
- limesurveyA Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install...8.8 High
- tribal systems zenario cms, tribalsystems zenario +1 moreFile upload restriction bypass in Zenario CMS7.2 High
- zfaka project zfakaAn issue was found in Zfaka <= 1.4.5. The verification of the background file upload function...9.8 Critical
- wikidocsWikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can...8.8 High
- showdoc, star7th star7th/showdoc +1 moreUnrestricted Upload of File with Dangerous Type in star7th/showdoc7.2 High
- mingsoft mcmsFile upload leading to RCE in MCMS9.8 Critical
- jqueryformForms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow...9.8 Critical
- diyhi bbs forumAn issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary...9.8 Critical
- schneider-electric interactive graphical scada system data collectorA CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead...9.8 Critical
- exponentcms exponent cmsExponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in...7.2 High
- siemens comos, comos v10.2, comos v10.3 +1 more +3 moreA vulnerability has been identified in COMOS V10.2 (All versions only if web components are used)...7.5 High
- ocproducts composrAuthenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote...8.8 High
- hyphp hybbs2update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP...8.8 High
- thinkupthemes responsive vector maps, unknown rvm – responsive vector maps +1 moreRVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read6.5 Medium
- jsdecena jsdecena/laracom, laracom project laracom +1 moreUnrestricted Upload of File with Dangerous Type in jsdecena/laracom8.1 High
- ujcms jspxcmsA vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows...9.8 Critical
- voipmonitorThe config restore function of Voipmonitor GUI before v24.96 does not properly check files sent...8.8 High
- motioneye project motioneye, motioneyeos project motioneyeos +1 moreUnrestricted Upload of File with Dangerous Type in motionEye7.2 High
- Show moreLoading…