CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester online tours & travels management system, online tours \& travels management system project tours \& travels management system +1 moreSourceCodester Online Tours & Travels Management System ab.php unrestricted upload4.7 Medium
- sitecore experience manager, experience platform +1 moreAn issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted...7.2 High
- cm-wp auto featured image, themeisle auto featured image (auto post thumbnail) +1 moreAuto Featured Image < 3.9.16 - Author+ Arbitrary File Upload8.8 High
- 115cmsGuizhou 115cms index unrestricted upload4.7 Medium
- haloAn arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary...4.8 Medium
- avantfaxA File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file...8.8 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreUnrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit7.2 High
- ucms project ucmsUCMS System File Management Module fileedit.php unrestricted upload6.3 Medium
- smartbear zephyr enterpriseSmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files,...7.5 High
- wyomind help deskAn issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows...9.8 Critical
- upthemes theme designfolio plus, designfolio-plus +1 moreUpThemes Theme DesignFolio Plus unrestricted upload6.3 Medium
- envato elements, template kit – import, elements – photos & elementor templates +1 more +3 moreEnvato Elements <= 2.0.10 & Template Kit <= 1.0.13 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- najeebmedia woocommerce checkout field managerWooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- shopex ecshopECshop New Product unrestricted upload4.7 Medium
- shopex ecshopECshop Backup Database database.php unrestricted upload4.7 Medium
- onekeyadminAn arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3...9.8 Critical
- yf-exam project yf-examCleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix...7.5 High
- dataiku data science studioIn Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the...6.5 Medium
- smeup erpSme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability.8.8 High
- laravel-adminlaravel-admin has Arbitrary File Upload vulnerability7.2 High
- balero cms project cmsFile Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code...7.2 High
- umbraco formsFile upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute...9.8 Critical
- judging management system project management systemJudging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability...8.1 High
- hybrid software cloudflowCloudflow - Unauthenticated file upload vulnerability9.8 Critical
- instantdeveloper rd3File upload vulnerability in Instantdeveloper RD3 22.0.8500, allows attackers to execute...9.8 Critical
- octopus serverIn affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which...7.5 High
- mayurik best pos management systemSourceCodester Best POS Management System Image save_settings unrestricted upload4.7 Medium
- bdtask pharmacy management system, pharmacy management system project management system +1 morecodeprojects Pharmacy Management System Avatar Image add.php unrestricted upload6.3 Medium
- bearadmin project bearadminFile Upload Vulnerability in Yupoxion BearAdmin before commit...9.8 Critical
- cisco secure email, secure email and web manager, email security appliance +2 moreA vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and...6.5 Medium
- splunk, splunk enterprise, cloud platform +2 moreUnnecessary File Extensions Allowed by Lookup Table Uploads in Splunk Enterprise4.3 Medium
- sap businessobjects business intelligence platform (cmc), businessobjects business intelligence platform +1 moreSAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an...8.4 High
- sap business planning and consolidationSAP Business Planning and Consolidation - versions 200, 300, allows an attacker with business...5.4 Medium
- shortpixel enable media replaceEnable Media Replace < 4.0.2 - Author+ Arbitrary File Upload8.8 High
- oretnom23 online food ordering systemAn arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering...9.8 Critical
- shopex ecshopEcShop PHP File template.php unrestricted upload4.7 Medium
- institutional management website project management websiteFile upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows...9.8 Critical
- oretnom23 raffle draw systemRaffle Draw System v1.0 was discovered to contain a local file inclusion vulnerability via the...9.8 Critical
- phpwcmsFile Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via...8.8 High
- pimcoreMissing file upload type validation in pimcore/pimcore8.2 High
- fastcms project fastcmsFastCMS Template Management unrestricted upload5.3 Medium
- mengnai aapanel host systemMonnai aaPanel host system v1.5 contains an access control issue which allows attackers to...9.8 Critical
- tecrail responsive filemanagerAn issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file...8.8 High
- nosh chartingsystem project chartingsystemNOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice...8.8 High
- ftdms project ftdmsAn arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code...7.2 High
- trend micro apex oneA file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a...9.1 Critical
- serinf fast checkinAn arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows...9.8 Critical
- schneider electric apc easy ups online monitoring software, easy ups online monitoring software +1 moreA CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause...9.8 Critical
- i-librariani-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.9.8 Critical
- unknown membership for woocommerceMembership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- Show moreLoading…