CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- l7 networks instantqos, instantscan +1 moreL7 Networks InstantScan & InstantQoS - Arbitrary File Upload9.8 Critical
- campcodes supplier management system, supplier management system project management system +1 morecode-projects Supplier Management System Picture btn_functions.php unrestricted upload6.3 Medium
- ibm security directory suite vaIBM Security Directory Suite VA file upload7.2 High
- thinkadminAn arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows...6.1 Medium
- ujcmsFile upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.9.8 Critical
- tmt lockcell, tmtmakine lockcell firmware +1 moreFile Upload in TMT's Lockcell9.8 Critical
- chamilo lmsAn arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up...9.8 Critical
- ckeditorA unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature...9.8 Critical
- agilebio labcollectorLabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged...8.8 High
- phpgurukul teachers record management system, teachers record management system project record management system +1 morePHPGurukul Teachers Record Management System Profile Picture changeimage.php unrestricted upload6.3 Medium
- ptc vuforia studioPTC Vuforia Studio Unrestricted Upload of File with Dangerous Type8.0 High
- tunafish adning advertisingAdning Advertising <= 1.5.5 - Arbitrary File Upload9.8 Critical
- al imran akash recentlyRecently <= 3.0.4 - Arbitrary File Upload to Remote Code Exectution8.8 High
- adsanityplugin adsanity, xen +1 moreAdSanity < 1.8.2 - Authenticated Arbitrary File Upload8.8 High
- delete all comments project all comments, ganesh chandra delete all comments +1 moreDelete All Comments <= 2.0 - Arbitrary File Upload9.8 Critical
- magazine3 pwa for wp – progressive web apps made simple, pwa for wp \& amp +1 morePWA for WP & AMP <= 1.7.32 - Arbitrary File Upload8.8 High
- plugin-planet user submitted posts, specialk user submitted posts – enable users to submit posts from the front end +1 moreUser Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload9.8 Critical
- king-theme page builder king composer, kingthemes page builder: kingcomposer – free drag and drop page builder by king-theme +1 morePage Builder: KingComposer < 2.9.4 - Arbitrary File Upload8.8 High
- phpokAn arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers...8.8 High
- alistgo alistalist Incorrect Access Control vulnerability8.8 High
- kiwitcms kiwi, kiwi tcms +1 moreStored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS8.1 High
- faculty evaluation system project evaluation systemSourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip...7.2 High
- advantech webaccess/scada, webaccess\/scada +1 moreIn Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability...7.2 High
- advantech webaccess/scada, webaccess\/scada +1 moreIn Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload...7.2 High
- marsctf project marsctfMarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading...9.8 Critical
- joommasters jms sliderPrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.9.8 Critical
- emlog*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain...7.5 High
- agro-school management system project management system, code-projects agro-school management system +1 morecode-projects Agro-School Management System Attachment Image btn_functions.php unrestricted upload6.3 Medium
- mobatime web applicationMobatime web application - Arbitrary file upload (RCE)8.1 High
- mitsubishi electric corporation melsec iq-f series ethernet/ip module fx5-enet/ip, melsec iq-r series ethernet/ip module rj71eip91, mitsubishielectric fx5-enet\/ip firmware +3 more +5 moreInformation disclosure, tampering, deletion and destruction vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules6.3 Medium
- itpison omicard edmITPison OMICARD EDM - Arbitrary File Upload6.8 Medium
- wade digital design co, ltd. fantsy, wddgroup fantasy +1 moreWADE DIGITAL DESIGN CO, LTD. FANTSY - Arbitrary File Upload8.8 High
- automattic vaultpress, unspecified vaultpress plugin +1 moreVaultPress Plugin MailPoet Plugin class.vaultpress-hotfixes.php protect_aioseo_ajax unrestricted upload6.3 Medium
- kramerav via go2 firmwareKramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote...9.8 Critical
- parse-community parse-serverParse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file6.3 Medium
- faronics insightAn issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is...8.8 High
- supcon simfield, supcontech simfield firmware +1 moreSupcon SimField reportupload.aspx unrestricted upload4.7 Medium
- atlassian confluence server, confluence data center +1 moreAffected versions of Atlassian Confluence Server allow remote attackers who have read permissions...4.3 Medium
- phpokPHPOK unrestricted upload4.7 Medium
- sofawiki project sofawikiSofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution.9.8 Critical
- monkey wrench inc. mw wp form, mw wp form project wp form +1 moreUnrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier,...9.8 Critical
- microengine mailformUnrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1...9.8 Critical
- kiwitcms kiwi, kiwi tcms +1 morekiwitcms vulnerable to stored XSS via unrestricted files upload8.1 High
- wcmsIn Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend...9.8 Critical
- rental module project module, unknown rental module +1 moreMalicious File Upload vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform.9.8 Critical
- perfree perfreeblogAn arbitrary file upload vulnerability in the component /admin/ThemeController.java of...9.8 Critical
- code-projects simple photo gallery, simple photo gallery project photo gallery +1 morecode-projects Simple Photo Gallery unrestricted upload6.3 Medium
- freeguppy guppyGuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to...9.8 Critical
- jinher oa, tongda2000 tongda office anywhere +1 moreTongda OA GatewayController.php actionGetdata unrestricted upload6.3 Medium
- oretnom23 online computer and laptop storeSourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead...9.8 Critical
- Show moreLoading…