CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- addify role based pricing for woocommerceRole Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload8.8 High
- online tours \& travels management system project tours \& travels management systemOnline Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload...7.2 High
- frauscher sensortechnik diagnostic system fds102, frauscher diagnostic system 102 +1 moreFrauscher Sensortechnik Diagnostic System FDS102 for FAdC R2 and FAdCi R2 configuration upload vulnerability9.8 Critical
- codeastro restaurant pos systemAn arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows...7.2 High
- vehicle booking system project booking systemAn arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0...7.2 High
- m-files hubshareBroken access controls on PDFtron WebviewerUI in M-Files Hubshare6.3 Medium
- forma lms, formalms forma lms, formalms +2 moreFile Upload vulnerability in Forma LMS9.9 Critical
- forma lms, formalms forma lms, formalms +2 moreUnrestricted Upload of File with Dangerous Type in Forma LMS9.9 Critical
- oretnom23 clinic\'s patient management systemRemote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload...9.8 Critical
- easyii cms, easyiicms +1 moreeasyii CMS File Upload Management Upload.php file unrestricted upload6.3 Medium
- opennebulaUnrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on...4.3 Medium
- honeywell experion pks, application control environment firmware, c200 firmware +2 more +4 moreHoneywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type10.0 Critical
- eaton foreseer epms, foreseer electrical power monitoring system +1 moreUnrestricted file upload in Eaton Foreseer EPMS8.1 High
- webassembly wabtwasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.5.5 Medium
- canteen management system project management systemCanteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability...7.2 High
- canteen management system project management systemCanteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability...7.2 High
- online pet shop we app project pet shop we appOnline Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via...7.2 High
- online pet shop we app project pet shop we appOnline Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via...7.2 High
- uasoft badasoBadaso vulnerable to Remote Code Execution via malicious file upload9.8 Critical
- mitel micollabA vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow...9.8 Critical
- flipped-aurora gin-vue-adminGin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type9.8 Critical
- emlogEmlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.7.2 High
- simple exam reviewer management system project exam reviewer management systemSimple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.7.2 High
- simple exam reviewer management system project exam reviewer management systemIn Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file...8.8 High
- eve-ngAn arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2...7.2 High
- momofoolish sra-adminsra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload8.2 High
- online tours \& travels management system project tours \& travels management systemOnline Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload...7.2 High
- billing system project systemAn arbitrary file upload vulnerability in the component /php_action/editProductImage.php of...7.2 High
- zgr tps200 ng, zigor zgr tps200 ng firmware +1 moreZGR TPS200 NG Missing Reference to Active Allocated Resource10.0 Critical
- flipped-aurora gin-vue-adminGin-vue-admin - Unrestricted File Upload9.0 Critical
- 74cms 74cmsseAn arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13...9.8 Critical
- chamiloChamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows...8.8 High
- boxbilling, boxbilling boxbilling/boxbilling +1 moreUnrestricted Upload of File with Dangerous Type in boxbilling/boxbilling7.2 High
- oretnom23 simple cold storage management systemSourceCodester Simple Cold Storage Management System Avatar unrestricted upload4.7 Medium
- flipped-aurora gin-vue-adminGin-vue-admin - Unrestricted File Upload9.0 Critical
- wedding planner project plannerWedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the...8.8 High
- wedding planner project plannerWedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the...8.8 High
- online diagnostic lab management system project diagnostic lab management systemOnline Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload...7.2 High
- online diagnostic lab management system project diagnostic lab management systemOnline Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload...7.2 High
- itsourcecode human resource management systemSourceCodester Human Resource Management System Image File employeeview.php unrestricted upload6.3 Medium
- wedding planner project plannerWedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php.8.8 High
- democritus d8s-asnsThe d8s-asns package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-xmlThe d8s-xml package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-networkingThe d8s-networking package for Python, as distributed on PyPI, included a potential code...9.8 Critical
- democritus d8s-file-systemThe d8s-file-system package for Python, as distributed on PyPI, included a potential code...9.8 Critical
- democritus d8s-algorithmsThe d8s-algorithms package for Python, as distributed on PyPI, included a potential code...9.8 Critical
- democritus d8s-listsThe d8s-lists package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-ip-addressesThe d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code...9.8 Critical
- democritus d8s-asnsThe d8s-asns package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-urlsThe d8s-urls package for Python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- Show moreLoading…