CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- generex cs141 firmware, ups cs141, ups-cs141 +2 moreUnrestricted Upload of File vulnerability in Generex CS1417.5 High
- dedecmsAn arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier...8.8 High
- economizzerEconomizzer remote code execution vulnerability8.8 High
- glpi-project glpiFile deletion through document upload process in GLPI7.7 High
- siberiancmsSiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method7.2 High
- coline welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload...7.2 High
- miniorange prevent files / folders access, prevent files \/ folders access +1 morePrevent files / folders access < 2.5.2 - Admin+ Arbitrary File Upload7.2 High
- d-link dar-8000, dlink dar-8000 firmware +1 moreD-Link DAR-8000 changelogo.php unrestricted upload6.3 Medium
- d-link dar-7000, dar-8000, dlink dar-7000 firmware +1 more +3 moreD-Link DAR-7000/DAR-8000 web.php unrestricted upload6.3 Medium
- d-link dar-7000, dlink dar-7000 firmware +1 moreD-Link DAR-7000 userattestation.php unrestricted upload6.3 Medium
- d-link dar-7000, dar-8000, dlink dar-7000 firmware +1 more +3 moreD-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload6.3 Medium
- d-link dar-7000, dlink dar-7000 firmware +1 moreD-Link DAR-7000 updateos.php unrestricted upload6.3 Medium
- d-link dar-7000, dar-8000, dlink dar-7000 firmware +1 more +3 moreD-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload6.3 Medium
- d-link dar-7000, dlink dar-7000 firmware, dar-8000 firmware +2 moreD-Link DAR-7000 licence.php unrestricted upload6.3 Medium
- d-link dar-7000, dar-8000, dlink dar-7000 firmware +1 more +3 moreD-Link DAR-7000/DAR-8000 updateos.php unrestricted upload6.3 Medium
- dataeaseDataEase has a vulnerability to obtain user cookies7.5 High
- jenkinsJenkins temporary uploaded file created with insecure permissions8.1 High
- telstra arcadyan lh1000, smart modem gen 2 (arcadyan lh1000), arcadyan lh1000 firmware +2 moreUnauthenticated configuration restore and firmware update8.8 High
- schollz crocCroc sender may send dangerous new files to receiver7.8 High
- fl3xx crew, dispatch +1 moreUnrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a...8.8 High
- elitecms elite cmsA file upload vulnerability in EliteCMS 1.01 allows a remote attacker to execute arbitrary code...8.8 High
- corecode macupdaterAn XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2,...7.8 High
- dolibarr erp\/crmFile Upload vulnerability in Dolibarr ERP CRM8.8 High
- openupload project openuploadFile Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute...8.8 High
- my food recipe project food recipe, sourcecodester my food recipe +1 moreSourceCodester My Food Recipe Image Upload index.php unrestricted upload6.3 Medium
- bettershop laiketuiBettershop LaikeTui unrestricted upload6.3 Medium
- gradio project gradioGradio arbitrary file upload vulnerability4.8 Medium
- lenosp project lenospAn arbitrary file upload vulnerability in the /user/upload component of lenosp 1.0-1.2.0 allows...8.8 High
- palantir gotham cerberus, com.palantir.acme.cerberus:cerberus +1 moreStored XSS in cerberus attachments6.8 Medium
- rockwell automation fa, rockwellautomation factorytalk view +1 moreFactoryTalk View Machine Edition Vulnerable to Remote Code Execution9.8 Critical
- siemens qms automotiveA vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected...5.7 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreInsufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)8.7 High
- dedecmsDedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.9.8 Critical
- agentejo cockpitCockpit CMS arbitrary file upload vulnerability6.1 Medium
- resort data processing, inc. irm next generation, resortdata internet reservation module next generation +1 moreImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in RDPngFileUpload.dll9.9 Critical
- bookreenUnrestricted File Upload in Bookreen7.2 High
- tef portalTEF portal 2023-07-17 is vulnerable to authenticated remote code execution.8.8 High
- adlered bolo-soloFile Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute...9.8 Critical
- byzoro smart s85f management platform, smart s85f firmware +1 moreByzoro Smart S85F Management Platform updateos.php unrestricted upload6.3 Medium
- diaowen dwsurveyFile Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to...9.8 Critical
- grupposcai realgimmAn arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm...8.8 High
- grupposcai realgimmAn arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1...9.8 Critical
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.24.6 - Unauthenticated Arbitrary File Upload9.8 Critical
- earcms earAn issue found in Earcms Ear App v.20181124 allows a remote attacker to execute arbitrary code...9.8 Critical
- saho adm-100fp, adm100, adm-100 firmware +1 more +3 moreSaho ADM100&ADM-100FP - Arbitrary File Upload9.8 Critical
- perfree perfreeblogAn issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via...7.2 High
- bettershop laiketuiBettershop LaikeTui POST Request unrestricted upload6.3 Medium
- e-excellence u-office forcee-Excellence U-Office Force - Arbitrary File Upload9.8 Critical
- artica pfms pandora fms, pandora fms fms +1 moreRemote Code Execution via Unrestricted File Upload6.4 Medium
- boidcmsFile Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code...8.8 High
- Show moreLoading…