CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- techvill paymoneyPayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists...8.0 High
- garage management system project management systemGarage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of...8.8 High
- aerocms project aerocmsAeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component...8.8 High
- anydeskAn issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary...8.8 High
- cuppacmsCuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File...9.8 Critical
- codeprojects online driving school, online driving school project project driving school project +1 morecodeprojects Online Driving School registration.php unrestricted upload6.3 Medium
- feehi feehicmsFeehiCMS has an arbitrary file upload vulnerability9.8 Critical
- garage management system project management systemAn arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage...7.2 High
- online ordering system project ordering systemAn arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add...7.2 High
- garage management system project management systemThe application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File...8.8 High
- seiko-sol skybridge mb-a100 firmware, skybridge mb-a110 firmware +1 moreSeiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload...9.8 Critical
- clarolineClaroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.9.8 Critical
- 72crm wukong crm72crm 9.0 has an Arbitrary file upload vulnerability.9.8 Critical
- dmitrylitvinov uploading svg, webp and ico files (wordpress plugin), uploading svg\, webp and ico files project svg\, webp and ico files +1 moreWordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability7.2 High
- ibm hardware management console 7063-cr2 firmware, power 9 ac922, power system ac922 \(8335-gtg\) firmware +2 more +4 moreIBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity...4.5 Medium
- baijiacms project baijiacmsBaijicms v4 was discovered to contain an arbitrary file upload vulnerability.9.8 Critical
- advancedcustomfields advanced custom fields, todo advanced custom fields pro +1 moreAdvanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload8.8 High
- simple and nice shopping cart script project and nice shopping cart script, sourcecodester simple and nice shopping cart script +1 moreSourceCodester Simple and Nice Shopping Cart Script profile.php unrestricted upload6.3 Medium
- greyd greyd.suite, unknown greyd suite +1 moreGREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCE9.8 Critical
- phpgurukul zoo management systemSourceCodester Zoo Management System apply_vacancy.php unrestricted upload6.3 Medium
- gas agency management system project agency management system, sourcecodester gas agency management system +1 moreSourceCodester Gas Agency Management System oneWord.php unrestricted upload6.3 Medium
- company website cms project website cms, sourcecodester company website cms +1 moreSourceCodester Company Website CMS add-portfolio.php unrestricted upload6.3 Medium
- company website cms project website cms, sourcecodester company website cms +1 moreSourceCodester Company Website CMS Add Service add-service.php unrestricted upload6.3 Medium
- code-projects gym management system, gym management system project management system +1 moreSourceCodester Gym Management System unrestricted upload4.7 Medium
- simple online book store system project online book store system, sourcecodester simple online book store system +1 moreSourceCodester Simple Online Book Store System Admin_ add.php unrestricted upload6.3 Medium
- code-projects gym management system, gym management system project management system +1 moreSourceCodester Gym Management System Background Management add_exercises.php unrestricted upload6.3 Medium
- company website cms project website cms, sourcecodester company website cms +1 moreSourceCodester Company Website CMS Add Blog add-blog.php unrestricted upload6.3 Medium
- company website cms project website cms, sourcecodester company website cms +1 moreSourceCodester Company Website CMS Background Upload Logo Icon updatelogo.php unrestricted upload6.3 Medium
- ucms project ucmsUCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file.9.8 Critical
- airspan airspot 5410 firmwareIn Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote...9.1 Critical
- mediajedi user private files, unknown frontend file manager & sharing – user private files +1 moreUser Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload8.8 High
- wpwax directorist, unknown directorist – wordpress business directory plugin with classified ads listings +1 moreDirectorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload4.9 Medium
- company website cms project website cms, sourcecodester company website cms +1 moreSourceCodester Company Website CMS unrestricted upload6.3 Medium
- alphaware e-commerce system project e-commerce system, sourcecodester alphaware simple e-commerce system +1 moreSourceCodester Alphaware Simple E-Commerce System Background Management Page admin_feature.php unrestricted upload6.3 Medium
- jeecg boot, unspecified jeecg-boot +1 morejeecg-boot unrestricted upload7.3 High
- mealie project mealieMealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to...9.8 Critical
- ideastocode enable svg, webp & ico upload (wordpress plugin), enable svg\, webp \& ico upload +1 moreWordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability7.2 High
- hiby r3 pro firmware, r3 pro saber firmware +1 moreHiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the...9.8 Critical
- opensourcepos open source point of saleOpen Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability...7.2 High
- barangay management system project management systemBarangay Management System v1.0 was discovered to contain a remote code execution (RCE)...7.2 High
- sims project simsSims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ...8.8 High
- feehi cmsFeehi CMS arbitrary code execution via crafted PHP file8.8 High
- openteknik open source social networkOpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary...7.2 High
- dataeaseDataease v1.11.1 SQL Injection via parameter dataSourceId9.8 Critical
- givewp, givewp (wordpress plugin) +1 moreWordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Creation via Export function vulnerability9.1 Critical
- drupal core, drupal +1 moreDrupal core arbitrary PHP code execution7.2 High
- barangay management system project management systemBarangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability...7.2 High
- dsk dsknetAn issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow...8.8 High
- wpallimport wp all import, wp all import – drag & drop import for csv, xml, excel & google sheets +1 moreImport any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload7.2 High
- octobotOctobot mishandles Tentacles upload9.8 Critical
- Show moreLoading…