CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- aerocms project aerocmsAeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post...7.2 High
- bigantsoft bigant office messenger 5An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver...8.8 High
- std42 elfinderelFinder Unrestricted File Upload vulnerability9.8 Critical
- online project time management system project project time management systemOnline Project Time Management System v1.0 was discovered to contain an arbitrary file write...8.8 High
- baigo cmsA remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow...7.2 High
- dascomsoft eziosuiteeZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload...8.8 High
- jellycmsJellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via ...8.8 High
- horizontcms project horizontcmsFile upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *...9.8 Critical
- haloHalo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the...7.5 High
- hisiphpAn Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed...7.2 High
- mappresspro mappress, unknown mappress maps for wordpress +1 moreMapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution7.2 High
- unknown library file managerLibrary File Manager < 5.2.3 - Subscriber+ Arbitrary File Creation/Upload/Deletion8.1 High
- online car rental system project car rental systemCar Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component...8.8 High
- ecommerce-website project ecommerce-websiteAn unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0...8.8 High
- idearespa reftreeAn unrestricted file upload vulnerability in IdeaRE RefTree before 2021.09.17 allows remote...8.8 High
- auvesy-mdt autosave, autosave for system platform, mdt software a4sp +1 more +3 moreMDT AutoSave Unrestricted Upload of File with Dangerous Type7.5 High
- dell wyse management suiteDell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload...7.2 High
- wpanel cms project cmsUnrestricted Upload of File with Dangerous Type in WPanel 48.8 High
- hospital management system project management systemHospital Management System v1.0 is affected by an unrestricted upload of dangerous file type...9.8 Critical
- oretnom23 banking systemA remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows...9.8 Critical
- tekon kio-1m firmware, kio-2m firmware, kio-2md firmware +5 more +7 moreTekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to...9.1 Critical
- trend micro apex central, trend micro, inc. micro apex central, trendmicro apex one +2 moreAn arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated...9.8 Critical
- student attendance management system project attendance management systemA File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via...9.8 Critical
- diyhi bbsA File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function...7.2 High
- diyhi bbsA File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function,...7.2 High
- diyhi bbsA File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType...7.2 High
- diyhi bbsA File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function...7.2 High
- diyhi bbsA File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.7.2 High
- sermon browser project browser, unknown sermon browser +1 moreSermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF8.8 High
- checkmkThe web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not...8.8 High
- taogogo taocmsAn arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2...9.8 Critical
- saturdaydrive ninja forms - file uploads, ninjaforms ninja forms file uploads +1 moreNinja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload9.8 Critical
- vmware carbon black app controlVMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7...9.1 Critical
- ge ur family, multilin b30 firmware, multilin b90 firmware +17 more +19 moreGE UR family Unrestricted Upload of File with Dangerous Type9.8 Critical
- crater-invoice crater-invoice/crater, craterapp crater +1 moreUnrestricted Upload of File with Dangerous Type in crater-invoice/crater7.2 High
- showdoc, star7th star7th/showdoc +1 moreThere is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc9.1 Critical
- bigantsoft bigant serverBigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues.8.8 High
- tms-outsource amelia, unknown amelia – events & appointments booking calendar +1 moreAmelia < 1.0.46 - Manager+ RCE8.8 High
- gogs, gogs gogs/gogs +1 moreRemote Command Execution in uploading repository file in gogs/gogs9.9 Critical
- diaowen dwsurveyDWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component...9.8 Critical
- shopxoThe PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0...7.8 High
- shopxoAn arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows...7.8 High
- classcmsClasscms v2.5 and below contains an arbitrary file upload via the component \class\classupload....7.8 High
- expresstech responsive menu, responsive menu (wordpress plugin) +1 moreWordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability8.3 High
- opendocmanAn attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via...9.8 Critical
- online admission system project admissions systemThe Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of...9.8 Critical
- pluck-cms pluckIn Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action...7.2 High
- spatie laravel media libraryThe Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows...9.8 Critical
- open source pgadmin, pgadmin 4 +1 morepgAdmin 4 Path Traversal vulnerability6.5 Medium
- thedigitalcraft atomcmsAtom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin...9.8 Critical
- Show moreLoading…