CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- microweberAn Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to...8.8 High
- arox school erp proArox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities...8.8 High
- eveo urve web manager, urve web manager +1 moreURVE Web Manager uploader.php unrestricted upload8.0 High
- eveo urve web manager, urve web manager +1 moreURVE Web Manager upload.php unrestricted upload8.0 High
- eveo urve web manager, urve web manager +1 moreURVE Web Manager img_upload.php unrestricted upload8.0 High
- hap-wi roxy-wiRoxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload10.0 Critical
- ibm security verify governanceIBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious...3.8 Low
- ibm engineering lifecycle optimization - publishing, engineering lifecycle optimization publishing +1 moreIBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could...5.7 Medium
- verizon lvskihp indoorunit firmwareVerizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL...9.8 Critical
- verizon lvskihp indoorunit firmware, lvskihp outdoorunit firmware +1 moreOn Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices,...7.5 High
- ruoyiRuoYi 4.7.3 vulnerable to arbitrary file upload in background management module5.4 Medium
- strapiStrapi 4.1.12 Cross-site Scripting via crafted file8.8 High
- microsoft windows 10 version 20h2, windows 10 version 21h1, windows 10 version 21h2 +6 more +8 moreWindows Server Service Tampering Vulnerability8.8 High
- zulip, zulip server +1 moreZulip Server public data export contains attachments that are non-public4.9 Medium
- sourcecodester clinics patient management system, oretnom23 clinic\'s patient management system +1 moreSourceCodester Clinics Patient Management System unrestricted upload6.3 Medium
- syntacticsinc easync, unknown free booking plugin for hotels, restaurant and car rental – easync +1 moreeaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload9.8 Critical
- gfi archiverFile upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure...9.8 Critical
- codologic codoforumCodoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo...7.2 High
- imagely nextgen galleryIn nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow...8.8 High
- imagely nextgen galleryIn nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow...6.5 Medium
- dice project diceAn arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code...9.8 Critical
- mozilla firefoxAn attacker who could have convinced a user to drag and drop an image to a filesystem could have...8.8 High
- mozilla firefoxAn attacker who could have convinced a user to drag and drop an image to a filesystem could have...8.8 High
- soflyy wp all import, unknown import any xml or csv file to wordpress +1 moreWP All Import < 3.6.8 - Admin+ Arbitrary File Upload7.2 High
- mingsoft mcmsUnrestricted Upload of File with Dangerous Type in MCMS9.8 Critical
- nucleuscms nucleus cmsNucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use...7.2 High
- haloHalo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the...9.8 Critical
- ldap-account-manager ldap account manager, ldapaccountmanager lam, debian linux +2 moreIncorrect Regular Expressions in ldap-account-manager6.6 Medium
- html2wp project html2wpHTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- library management system project management system, owthub library management system +1 moreSourceCodester Library Management System /card/index.php unrestricted upload6.3 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary...6.3 Medium
- secheron sepcos control and protection relay firmware package, sepcos control and protection relay firmware +1 moreSecheron SEPCOS Control and Protection Relay9.4 Critical
- user photo project photoIn WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated...8.8 High
- illumina iseq 100 instrument, local run manager, miniseq instrument +5 more +7 moreLRM does not restrict the types of files that can be uploaded to the affected product. A...10.0 Critical
- laiketuiLaiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker...9.8 Critical
- docebo** UNSUPPORTED WHEN ASSIGNED ** Docebo Community Edition v4.0.5 and below was discovered to...8.8 High
- contec sv-cpt-mc310 firmwareAn arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0...9.8 Critical
- polonel polonel/trudesk, trudesk project trudesk +1 moreUnrestricted Upload of File with Dangerous Type in polonel/trudesk9.6 Critical
- allow svg files project svg files, unknown allow svg files +1 moreAllow SVG Files < 1.1 - Admin+ Arbitrary File Upload7.2 High
- elefant cms, elefantcms elefant cms +1 moreElefant CMS File Upload drop privileges management6.3 Medium
- inventree inventree/inventree, inventree project inventree +1 moreUnrestricted Upload of File with Dangerous Type in inventree/inventree9.0 Critical
- maianmedia maianaffiliateA PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to...4.8 Medium
- advanced school management system project school management systemitsourcecode Advanced School Management System v1.0 is vulnerable to Arbitrary code execution via...7.2 High
- monstraMonstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload...9.8 Critical
- kreado kreasferoKreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can...9.8 Critical
- unknown wp svg icons, wp svg icons project svg icons +1 moreWP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)7.2 High
- maykinmedia open forms, open-formulieren open-forms +1 moreInsufficient content-type validation for uploaded files in open-forms7.6 High
- solare solar-log, solar-log 1000 firmware, 1000 pm\+ firmware +6 more +8 moreSolare Solar-Log File Upload privileges management6.5 Medium
- hitachi energy txpert hub coretec 4 version, hitachienergy txpert hub coretec 4 firmware +1 moreFirmware upload verification bypass in TXpert Hub CoreTec 46.7 Medium
- fudforumFUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File...7.2 High
- Show moreLoading…