CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- netscout ngeniusoneNetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.8.8 High
- car rental management system project rental management systemCar Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental...9.8 Critical
- rsa archerRSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.7.5 High
- max yi maxboardMaxboard multiple vulnerabilities9.8 Critical
- tpcms project tpcmsAn arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to...8.8 High
- wedding management system project management systemIn Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture...8.8 High
- wedding management system project management systemIn Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload...8.8 High
- wedding management system project management systemIn Wedding Management System v1.0, the editing function of the "Services" module in the...8.8 High
- wedding management system project management systemIn Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture...8.8 High
- elitecms elite cmselitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.9.8 Critical
- creatiwity witycmsAn arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to...8.8 High
- aceware aceweb online portalACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the...7.5 High
- aceware aceweb online portalACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability...9.8 Critical
- merchandise online store project online storeMerchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in...9.8 Critical
- mingsoft mcmsCode injection in MCMS9.8 Critical
- iminho mindocArbitrary command execution in Minidoc7.8 High
- roncoo roncoo-educationAn arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo...9.8 Critical
- oretnom23 online food ordering systemAn arbitrary file upload vulnerability in the Select Image function of Online Food Ordering...7.2 High
- zohocorp manageengine applications managerManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL...7.2 High
- sscms siteserver cmsSiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type ...9.8 Critical
- home clean services management system project clean services management system, unspecified home clean services management system +1 moreHome Clean Services Management System unrestricted upload4.7 Medium
- publify publify/publify, publify project publify +1 moreUnrestricted Upload of File with Dangerous Type in publify/publify9.1 Critical
- polonel polonel/trudesk, trudesk project trudesk +1 moreUnrestricted Upload of File with Dangerous Type in polonel/trudesk9.0 Critical
- pharmacy management system project management systemPharmacy Management System v1.0 was discovered to contain a remote code execution (RCE)...9.8 Critical
- foxit pdf editorFoxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.9.8 Critical
- subconverter project subconverterA remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute...9.8 Critical
- shopxoArbitrary file upload in ShopXO7.2 High
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0...6.5 Medium
- jenkins project pipeline: groovy plugin, jenkins pipeline\ +1 moreSandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin8.5 High
- gxcms project gxcmsGXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template...7.2 High
- e4jvikwp vikbooking hotel booking engine & pms, vikwp hotel booking engine \& pms +1 moreVikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload7.2 High
- advanced uploader project uploader, unknown advanced uploader +1 moreAdvanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload8.8 High
- unknown agil(automatic grid image listing), wpsocket automatic grid image listing +1 moreAGIL <= 1.0 - Admin+ Arbitrary File Upload7.2 High
- tiddlywiki tiddlywiki5Withdrawn: Code execution via SVG file upload in tiddlywiki9.8 Critical
- graphql-upload project graphql-uploadAn arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows...9.8 Critical
- keystonejs keystoneAn arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows...9.8 Critical
- connect-multiparty project connect-multipartyConnect-Multiparty allows arbitrary file upload7.8 High
- formidable project formidableFormidable arbitrary file upload9.8 Critical
- myscada mypromySCADA myPRO Unrestricted Upload of File with Dangerous Type7.5 High
- xxyopen novel-plusUnrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller...9.8 Critical
- hcl sametimeHCL Sametime is susceptible a file transfer service vulnerability8.2 High
- inhand networks inrouter302, inhandnetworks inrouter302 firmware +1 moreA file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks...9.9 Critical
- hospital management system project management systemHospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File...9.8 Critical
- wedding management system project management systemAn arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System...7.2 High
- car rental management system project rental management systemAn arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1...7.2 High
- bluditAn issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers...7.2 High
- cmsimple-xh cmsimple xhCMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this...10.0 Critical
- f5 big-ip afm, big-ip advanced firewall manager +1 moreOn F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x...7.2 High
- rainier open virtual simulation experiment teaching management platformBeijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching...9.8 Critical
- bosscmsAn arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd....9.8 Critical
- Show moreLoading…