CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- sierrawireless aleosImproper input leads to DoS7.1 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload8.8 High
- thinkadminThinkAdmin arbitrary file upload vulnerability8.8 High
- thinkadminAn issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to...8.8 High
- arslansoft education portalMalicious File Upload in ArslanSoft's Education Portal9.8 Critical
- arslansoft education portalPlaintext Storage of a Password in ArslanSoft's Education Portal7.5 High
- rocklobster contact form 7Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload6.6 Medium
- espocrmUnrestricted Upload of File with Dangerous Type in EspoCRM4.7 Medium
- espocrmUnrestricted Upload of File with Dangerous Type in EspoCRM4.7 Medium
- microweberMicroweber file upload vulnerability8.8 High
- chamilo, chamilo lms +1 moreChamilo LMS File Upload Functionality Remote Code Execution8.8 High
- chamilo, chamilo lms +1 moreChamilo LMS File Upload Functionality Remote Code Execution8.8 High
- chamilo, chamilo lms +1 moreChamilo LMS File Upload Functionality Remote Code Execution8.8 High
- chamilo, chamilo lms +1 moreChamilo LMS File Upload Functionality Remote Code Execution8.8 High
- chamilo, chamilo lms +1 moreChamilo LMS Unauthenticated Big Upload File Remote Code Execution8.1 High
- reputeinfosystems bookingpress, appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreBookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- arcserve udpArcserve UDP Unauthenticated RCE9.8 Critical
- asgaros forum, unknown asgaros forum +1 moreAsgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- four-faith video surveillance management systemXiamen Four-Faith Video Surveillance Management System Apache Struts unrestricted upload6.3 Medium
- sapplica sentrifugoIn Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated...8.8 High
- byzoro smart s80, smart s80 firmware +1 moreByzoro Smart S80 PHP File updatelib.php unrestricted upload6.3 Medium
- artica pandora fms, pandora fms fms +1 moreUploading executables via the file manager5.7 Medium
- artica pandora fms, pandora fms fms +1 moreRemote Code Execution via File Uploader7.6 High
- codedropz drag and drop multiple file upload - contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload8.1 High
- strangerstudios paid memberships pro, paid memberships pro – content restriction, user registration, & paid subscriptions +1 morePaid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x (expresscluster x) +1 more +3 moreCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X...8.8 High
- opensupportsOpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the...9.8 Critical
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload6.6 Medium
- statamic cms, statamic +1 moreRemote code execution via form uploads in statamic/cms8.8 High
- salesagility salesagility/suitecrm, suitecrm +1 moreUnrestricted Upload of File with Dangerous Type in salesagility/suitecrm5.4 Medium
- duncanmcclean guest-entries, guest entries +1 moreRemote code execution via file uploads in guest-entries8.8 High
- maiwei safety production control platformMaiwei Safety Production Control Platform unrestricted upload5.3 Medium
- statamic cms, statamic +1 moreStatamic CMS remote code execution via front-end form uploads8.4 High
- progress ws ftp serverWS_FTP Server Arbitrary File Upload9.1 Critical
- remoteclinic remote clinicRemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote...8.8 High
- atomicwebstrategy woocommerce ninja forms product add-onsWooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- ivanti avalancheIvanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation...7.8 High
- galaxy software services vitals esp, gss vitals enterprise social platform +1 moreGalaxy Software Services Vitals ESP - Arbitrary File Upload8.8 High
- glpi-project glpiGLPI vulnerable to unallowed PHP script execution10.0 Critical
- company website cms project website cms, sourcecodester company website cms +1 moreSourceCodester Company Website CMS Create Blog Page createblog unrestricted upload4.7 Medium
- bplugins icons font loader, icons font loader – load web fonts and icon libraries +1 moreIcons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- cisco identity services engine software, identity services engine +1 moreTwo vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload...4.7 Medium
- cisco identity services engine software, identity services engine +1 moreTwo vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload...4.7 Medium
- bitrix24Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload9.6 Critical
- bitrix24Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation8.8 High
- pkp pkp/pkp-lib, sfu pkp web application library +1 moreCross-site Scripting in pkp/pkp-lib3.5 Low
- hadskyAn arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary...8.8 High
- chef automate, progress software chef automate +1 moreAutomate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application9.9 Critical
- royal-elementor-addons royal elementor addons, unknown royal elementor addons and templates +1 moreRoyal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload9.8 Critical
- bigbluebuttonBigBlueButton Unrestricted File Upload vulnerability5.3 Medium
- Show moreLoading…