CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- admidio, admidio admidio/admidio +1 moreUnrestricted Upload of File with Dangerous Type in admidio/admidio6.7 Medium
- makeplane planePlane 0.7.1 - Insecure file upload7.1 High
- sonicwall analytics, gms, global management system +2 moreVulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a...9.8 Critical
- wpeverest user registration, user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder +1 moreUser Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload9.9 Critical
- sonicwall analytics, gms, global management system +2 moreVulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on...8.8 High
- dedecmsAn arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109...9.8 Critical
- simple online piggery management system project online piggery management systemOnline Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can...9.8 Critical
- istrong mountain flood disaster prevention monitoring and early warning systemSuncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System UpLoadFloodPlanFile UpLoadFloodPlanFile.ashx unrestricted upload6.3 Medium
- istrong mountain flood disaster prevention monitoring and early warning systemSuncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System Duty Write-UploadFile UploadFile.ashx unrestricted upload6.3 Medium
- istrong mountain flood disaster prevention monitoring and early warning systemSuncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System Duty Module UploadHandler.ashx unrestricted upload6.3 Medium
- websiteguide project websiteguideWebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.9.8 Critical
- online art gallery project art galleryProjectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary...9.8 Critical
- cmsmadesimple cms made simpleCMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.8.8 High
- zimbra collaborationFile Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute...8.8 High
- duxcms project duxcmsFile upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms...8.8 High
- kiwitcms kiwi, kiwi tcms +1 moreKiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen opening Diagcab files, Firefox did not warn the user that these files may contain malicious...7.8 High
- smartweb infotech job board, smartweb infotech job board project infotech job board +1 moreSmartWeb Infotech Job Board My Profile Page account unrestricted upload6.3 Medium
- sanchitkmr shopping websiteSourceCodester Shopping Website insert-product.php unrestricted upload6.3 Medium
- thedaylightstudio fuel cmsFile Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code...9.8 Critical
- thedaylightstudio fuel cmsPermissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code...9.8 Critical
- fossbilling, fossbilling fossbilling/fossbilling +1 moreUnrestricted Upload of File with Dangerous Type in fossbilling/fossbilling8.0 High
- wavlink wl-wn531ax2, wl-wn531ax2 firmware +1 moreWL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative...7.2 High
- sem-cms semcmsFile Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and...9.8 Critical
- chemexChemex through 3.7.1 is vulnerable to arbitrary file upload.9.8 Critical
- guantang equipment management system project equipment management systemGuantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload.7.2 High
- tecrail responsive filemanagerIn Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.9.8 Critical
- advancedfilemanager file manager advanced shortcode, unknown file-manager-advanced-shortcode +1 moreFile Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode9.8 Critical
- trendmicro mobile security, trend micro, inc. micro moibile security for enterprise +1 moreTrend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow...6.5 Medium
- trendmicro mobile security, trend micro, inc. micro moibile security for enterprise +1 moreTrend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow...6.5 Medium
- blogengine blogengine.netAn Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file,...9.8 Critical
- bluditBludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.8.8 High
- mgt-commerce cloudpanelIn CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication...8.8 High
- sourcecodester yoga class registration system, yoga class registration system class registration system +1 moreYoga Class Registration System 1.0 - RCE9.1 Critical
- funadminfuadmin vulnerable to insecure file upload9.8 Critical
- pluck-cms pluckAn issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers...7.2 High
- feehi feehicmsLiufee CMS File Upload vulnerability9.8 Critical
- nucleuscmsFile Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code...9.8 Critical
- wuzhicmsAn issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the...8.8 High
- feehi feehicmsliufee CMS File Upload vulnerability9.8 Critical
- pluck-cms pluckFile Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code...7.2 High
- pluck-cms pluckFile upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute...7.2 High
- 8cms ljcmsFile Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary...9.8 Critical
- pluck-cms pluckcmsFile Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute...9.8 Critical
- ebcmsFile upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via...8.8 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- sugarcrmAn issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An...8.8 High
- bluditBludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component ...5.4 Medium
- jeecg bootjeecg-boot unrestricted file upload vulnerability6.5 Medium
- itpison omicard edm, contact itpison +1 moreITPison OMICARD EDM - Arbitrary File Upload9.8 Critical
- Show moreLoading…