CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.5.2 Medium
- online leave management system project leave management systemOnline Leave Management System v1.0 was discovered to contain an arbitrary file upload...7.2 High
- yith woocommerce gift cards, yithemes yith woocommerce gift cards +1 moreWordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload9.8 Critical
- ayacms project ayacmsAyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.8.8 High
- thinkphpThinkphp has a code logic error8.8 High
- postmagthemes demo import, unknown postmagthemes demo import +1 morePostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload7.2 High
- zimbra collaborationAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can...7.2 High
- pwndoc project pwndocAn issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges...8.8 High
- house rental system project rental system, unspecified house rental system +1 moreHouse Rental System POST Request tenant-engine.php unrestricted upload6.3 Medium
- human resource management system project resource management system, itsourcecode human resource management system +1 moreSourceCodester Human Resource Management System Content-Type employee.php unrestricted upload7.3 High
- feminer wms, warehouse management system project management system +1 moreFeMiner wms unrestricted upload6.3 Medium
- rocketsoftware trufusionAn arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows...9.8 Critical
- rinvizle event registration systemSourceCodester Event Registration System unrestricted upload4.7 Medium
- contec solarview compact firmwareSolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file.9.8 Critical
- squirrly seo plugin by squirrly seo, seo plugin by squirrly seo (wordpress plugin) +1 moreWordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload7.6 High
- online tours \& travels management system project tours \& travels management systemOnline Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via...9.8 Critical
- purchase order management system project order management systemPurchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order...9.8 Critical
- prasathmani tiny file managerTiny File Manager version 2.4.8 allows an unauthenticated remote attacker to execute arbitrary...9.8 Critical
- wbce cmsAn arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows...7.2 High
- uasoft badasoBadaso vulnerable to Remote Code Execution (RCE)9.8 Critical
- churchdb churchinfoCartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through...8.8 High
- optilinknetwork op-xt71000n firmwareA vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1...9.8 Critical
- emerson proficy, emerson electric proficy machine edition +1 moreEmerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434...5.9 Medium
- isic.lk project isic.lkFile upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th...7.2 High
- api2cart bridge connector, bridge connector (wordpress plugin) +1 moreWordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability9.8 Critical
- gvectors wpforo forum, gvectors team wpforo forum (wordpress plugin) +1 moreWordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability9.9 Critical
- rconfigAn arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary...8.8 High
- dedecmsAn arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms...6.7 Medium
- mozilla firefoxWhen downloading an HTML file, if the title of the page was formatted as a filename with a...7.8 High
- hooskAn arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows...9.8 Critical
- canteen management system project management systemAn arbitrary file upload vulnerability in the component /pages/save_user.php of Canteen...9.8 Critical
- canteen management system project management systemAn arbitrary file upload vulnerability in the image upload function of Canteen Management System...7.2 High
- aureus erpjerryhanjj ERP Commodity Management inventory.php uploadImages unrestricted upload6.3 Medium
- etic telecom remote access server (ras), etictelecom remote access server firmware +1 moreETIC Telecom Remote Access Server Unrestricted Upload of File with Dangerous Type5.9 Medium
- flowring agentflow, agentflow bpm +1 moreFLOWRING Agentflow BPM - Arbitrary File Upload9.8 Critical
- ayacms project ayacmsAyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component ...9.8 Critical
- canteen management system project management systemCanteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability...7.2 High
- roxyfileman roxy filemanRoxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default...9.8 Critical
- democritus d8s-xmlThe d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- democritus d8s-networkingThe d8s-networking for python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-datesThe d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- democritus d8s-statsThe d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- democritus d8s-networkingThe d8s-networking for python, as distributed on PyPI, included a potential code-execution...9.8 Critical
- democritus d8s-pythonThe d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- democritus d8s-urlsThe d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- democritus d8s-timerThe d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor...8.8 High
- democritus d8s-pythonThe d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- democritus d8s-timerThe d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- democritus d8s-stringsThe d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor...9.8 Critical
- online tours and travels management system project tours and travels management systemOnline Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload...7.2 High
- Show moreLoading…