CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- wedding planner project plannerWedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.8.8 High
- church management system project management systemAn arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management...7.2 High
- democritus d8s-pdfsThe d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-utilityThe d8s-utility package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-htmlThe d8s-html package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-domainsThe d8s-domains package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-archivesThe d8s-archives package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-jsonThe d8s-json package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-utilityThe d8s-utility package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-yamlThe d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- dedecmsDedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the...7.2 High
- interspire email marketerInterspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php ...8.8 High
- sourcecodester web-based student clearance system, web-based student clearance system project student clearance system +1 moreSourceCodester Web-Based Student Clearance System Photo edit-photo.php unrestricted upload6.3 Medium
- backdropcms backdrop cmsBackdrop CMS Unrestricted File Upload vulnerability7.2 High
- online diagnostic lab management system project diagnostic lab management systemAn arbitrary file upload vulnerability in the component /php_action/editFile.php of Online...7.2 High
- online leave management system project leave management systemAn arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of...7.2 High
- creativedream file uploader project file uploaderArbitrary file upload vulnerability in php uploader9.8 Critical
- najeebmedia frontend file manager, unknown frontend file manager plugin +1 moreFrontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload8.8 High
- dedecmsDedeCMS 5.7.98 has a file upload vulnerability in the background.7.2 High
- mojoportalmojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows...8.8 High
- billing system project project system projectBilling System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability...7.2 High
- discourseDiscourse vulnerable to RCE via admins uploading maliciously zipped file9.1 Critical
- chamiloA zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute...8.8 High
- flatpressFlatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the...7.2 High
- exam reviewer management system project reviewer management systemIn Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file...8.8 High
- ec-cube product image bulk upload, ec-cube co.,ltd. product image bulk upload plugin +1 moreEC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient...9.8 Critical
- zfileZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component ...9.8 Critical
- cminds cm download managerCM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload7.2 High
- phpgurukul zoo management systemZoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point...7.2 High
- phpgurukul zoo management systemZoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point...7.2 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 moreAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload...9.8 Critical
- mattermost, mattermost server +1 moreServer-side Denial of Service while processing a specifically crafted GIF file3.1 Low
- simple college website project college websiteSimple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via...9.8 Critical
- phpgurukul zoo management systemIn Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture...7.2 High
- xplodedthemes wpide, wpide – file manager & code editor (wordpress plugin) +1 moreWordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability6.5 Medium
- soflyy import any xml or csv file to wordpress (wordpress plugin), wp all import +1 moreWordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability9.1 Critical
- octoprint, octoprint octoprint/octoprint +1 moreUnrestricted Upload of File with Dangerous Type in octoprint/octoprint3.7 Low
- pagekitPagekit vulnerable to Unrestricted Upload of File with Dangerous Type9.8 Critical
- d8s-python project d8s-pythonThe d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- d8s-xml project d8s-xmlThe d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- d8s-netstrings project d8s-netstringsThe d8s-netstrings for python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- d8s-grammars project d8s-grammarsThe d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- d8s-math project d8s-mathThe d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- d8s-json project d8s-jsonThe d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- d8s-archives project d8s-archivesThe d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- d8s-strings project d8s-stringsThe d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- d8s-pdfs project d8s-pdfsThe d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- garage management system project management systemGarage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action...7.2 High
- espocrmEspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload...8.8 High
- event management system project management systemEvent Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via...7.2 High
- Show moreLoading…