CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- yetiforcecompany yetiforcecompany/yetiforcecrm, yetiforce customer relationship management +1 moreUnrestructed file upload in yetiforcecompany/yetiforcecrm9.1 Critical
- simple doctor\'s appointment system project doctor\'s appointment systemSourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image...9.8 Critical
- web\@rchiv project web\@rchivAn arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary...9.8 Critical
- springbootmovie project springbootmovieIn SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in...7.2 High
- cisco firepower management center, secure firewall management center +1 moreCisco Firepower Management Center File Upload Security Bypass Vulnerability6.5 Medium
- importwp import wp, unknown import wp – import and export wordpress data to xml or csv files +1 moreImport WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE7.2 High
- rarathemes rara one click demo import, raratheme rara one click demo import (wordpress plugin) +1 moreWordPress Rara One Click Demo Import plugin <= 1.2.9 - Cross-Site Request Forgery (CSRF) leads to Arbitrary File Upload vulnerability8.8 High
- elcomplus smartptt, smartptt scada +1 moreElcomplus SmartPtt Unrestricted Upload of File with Dangerous Type9.8 Critical
- xxyopen novel-plusnovel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can...9.8 Critical
- bloofox bloofoxcmsbloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin...8.8 High
- ed01-cms project ed01-cmsED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin...8.8 High
- maxb maxboardMaxBoard XSS and File Upload Vulnerability8.1 High
- monstaftp monsta ftpMonstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to...9.8 Critical
- smartypants sp project & document manager, smartypantsplugins sp project \& document manager +1 moreSP Project & Document Manager < 4.24 - Subscriber+ Shell Upload8.8 High
- brandexponents tatsuTatsu < 3.3.12 - Unauthenticated RCE8.1 High
- ibm planning analytics workspaceIBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files...6.8 Medium
- ibm planning analytics workspaceIBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not...6.3 Medium
- typemillTypemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload...8.8 High
- victor cms project cmsVictor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the...8.8 High
- purchase order management system project order management systemPurchase Order Management System v1.0 was discovered to contain a remote code execution (RCE)...9.8 Critical
- ucms project ucmsAn arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code...8.8 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 moreZimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...7.2 High
- fancy-product-designer fancy product designerFancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- e4j s.r.l. vikbooking hotel booking engine & pms (wordpress plugin), vikwp vikbooking hotel booking engine \& property management system plugin +1 moreWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE9.8 Critical
- elementor website builder, elemntor elementor website builder +1 moreElementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution8.8 High
- wso2 api manager, enterprise integrator, identity server +6 more +8 moreCertain WSO2 products allow unrestricted file upload with resultant remote code execution. This...9.8 Critical
- causefx causefx/organizr, organizr +1 moreStored XSS viva .svg file upload in causefx/organizr9.0 Critical
- ghostArbitrary file upload in Ghost9.8 Critical
- payloadcms payloadUnrestricted Upload of File with Dangerous Type in Payload9.8 Critical
- strapiUnrestricted Upload of File with Dangerous Type in Strapi9.8 Critical
- sailsjs skipperAn arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows...9.8 Critical
- express-fileupload project express-fileuploadExpress-FileUpload Arbitrary File Overwrite7.5 High
- buttercmsUnrestricted Upload of File with Dangerous Type in ButterCMS9.8 Critical
- ghostArbitrary file upload in Ghost9.8 Critical
- express-fileupload project express-fileuploadAn arbitrary file upload vulnerability in the file upload module of Express-Fileupload v1.3.1...9.8 Critical
- hedgedocEnumerable upload file names in hedgedoc5.3 Medium
- ocdi one click demo importOne Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload7.2 High
- std42 elfinderRCE in Studio-42 elFinder on Windows before 2.1.619.8 Critical
- polonel polonel/trudesk, trudesk project trudesk +1 moreStored XSS viva .svg file upload in polonel/trudesk9.0 Critical
- newbee-mall project newbee-mallNewbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at ...9.8 Critical
- zbzcmsAn arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to...9.8 Critical
- zbzcmsAn arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to...9.8 Critical
- moguit mogu blog cmsmogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation.9.8 Critical
- ritecmsRiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin...7.2 High
- ecommerce-website project ecommerce-websiteEcommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via ...9.8 Critical
- simple house rental system project house rental systemSimple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability...8.8 High
- phpgurukul zoo management systemZoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ...9.8 Critical
- socialcodia social codia smsSocial Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via...7.2 High
- ecommerce-website project ecommerce-websiteEcommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via ...8.8 High
- musical world project worldMusical World v1 was discovered to contain an arbitrary file upload vulnerability via...8.8 High
- Show moreLoading…