CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- taogogo taocmsAn arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary...9.8 Critical
- openmage magento, magento-lts +1 moreOpenMage LTS DataFlow upload remote code execution vulnerability7.2 High
- limesurveyAn arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows...9.8 Critical
- artica pfms pandora fms, pandora fms fms +1 morePath Traversal leading to Local File Inclusion5.9 Medium
- bumsys project bumsys, unilogies unilogies/bumsys +1 moreUnrestricted Upload of File with Dangerous Type in unilogies/bumsys7.6 High
- blog-ssm project blog-ssmFile Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary...8.8 High
- thimpress learnpress, learnpress – wordpress lms plugin +1 moreWordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion9.3 Critical
- mingsoft mcmsArbitrary file write in net.mingsoft:ms-mcms8.8 High
- javaweb blog project blogAn issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and...9.8 Critical
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6,...4.3 Medium
- aidreform project aidreform, chimpgroup bolster, spikes +8 more +10 moreMultiple themes - Unauthenticated Arbitrary File Upload9.8 Critical
- dasherr project dasherrUnrestricted file upload leads to Remote Code Execution in erohtar/Dasherr9.8 Critical
- act project actUnrestricted file upload leading to privilege escalation in act8.0 High
- xpressengine, xehub xe3 xpresesengine +1 moreXpressEngine file upload vulnerability8.8 High
- cisco network services orchestratorA vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow...5.5 Medium
- popojicmsPopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.8.8 High
- ge proficy historianAn unauthorized user could alter or write files with full control over the path and content of...7.5 High
- tikiTiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an...7.2 High
- nvidia bmc, dgx servers +1 moreNVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and...6.0 Medium
- oretnom23 online food ordering systemSourceCodester Online Food Ordering System Menu Form unrestricted upload4.7 Medium
- 72crm wukong crm72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload...8.8 High
- bravenewcode wptouchWPtouch < 4.3.45 - Admin+ Arbitrary File Upload7.2 High
- b2evolution cmsRESERVED There is an arbitrary file upload vulnerability in b2evolution v7.2.5. Attackers can use...7.2 High
- easy test project test, hwa jiuh digital technology ltd. easytest +1 moreHWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload8.8 High
- tp-link tl-wr902ac firmwareTP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute...8.8 High
- dahuasecurity dhi-dss4004-s2 firmware, dhi-dss7016d-s2 firmware, dhi-dss7016dr-s2 firmware +2 more +4 moreSome Dahua software products have a vulnerability of unrestricted upload of file. After obtaining...7.2 High
- unknown return refund and exchange for woocommerceReturn Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload9.8 Critical
- planetestream planet estreamPlanet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video...9.8 Critical
- microweber, microweber microweber/microweber +1 moreUnrestricted Upload of File with Dangerous Type in microweber/microweber4.7 Medium
- ampache, ampache ampache/ampache +1 moreUnrestricted Upload of File with Dangerous Type in ampache/ampache3.1 Low
- nbnbk project nbnbkDefault version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the...9.8 Critical
- ayacms project ayacmsAyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php9.8 Critical
- classcms project classcmshere is an arbitrary file upload vulnerability in the file management function module of...9.8 Critical
- mozilla vpnMozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or...7.8 High
- wbce cmsWBCE CMS v1.5.4 can implement getshell by modifying the upload file type.9.8 Critical
- ultimatemember jobboardwpJobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload7.5 High
- aerocms project aerocmsIn AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source...7.2 High
- exactsoftware exact synergyAn arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy...7.8 High
- open-emr openemr, openemr openemr/openemr +1 moreUnrestricted Upload of File with Dangerous Type in openemr/openemr7.6 High
- feehi feehicmsFeehiCMS Unrestricted Upload vulnerability5.4 Medium
- ibarn project ibarnFile upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5...8.8 High
- sap business objects business intelligence platform, businessobjects business intelligence platform +1 moreSAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user...9.9 Critical
- themographics listingoListingo < 3.2.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- stylemixthemes motors, motors - car dealer\, classifieds \& listing +1 moreMotors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload8.8 High
- unknown booking calendar, appointment booking system, wpdevart booking calendar +1 moreBooking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- unknown user registrationUser Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload7.5 High
- alistgo alistAList vulnerable to Improper Preservation of Permissions8.8 High
- sens project sensSENS v1.0 has a file upload vulnerability.8.8 High
- dynamic transaction queuing system project transaction queuing systemAn arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic...7.2 High
- akeneo product information management, pim-community-dev +1 moreRemote php code execution in Akeneo PIM8.8 High
- Show moreLoading…