CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- booster for woocommerce, pluggabl booster elite for woocommerce +1 moreElite Booster for WooCommerce <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- byzronetwork management platformFile Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local...7.7 High
- getgrav gravRemote Code Execution by uploading a phar file using frontmatter8.8 High
- ailux imx6, imx6 bundle +1 moreA CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the ...5.5 Medium
- ailux imx6, imx6 bundle +1 moreA CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the ...5.9 Medium
- sourcecodester online mobile management store, oretnom23 online mobile store management system +1 moreSourceCodester Online Mobile Management Store Users.php unrestricted upload6.3 Medium
- mayurik petrol pump management, sourcecodester petrol pump management software +1 moreSourceCodester Petrol Pump Management Software service_crud.php unrestricted upload4.7 Medium
- mayurik petrol pump management, sourcecodester petrol pump management software +1 moreSourceCodester Petrol Pump Management Software product.php unrestricted upload4.7 Medium
- mayurik petrol pump managementFile Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute...9.8 Critical
- laragonRCE in Laragon9.8 Critical
- mollie payments for woocommerceWordPress Mollie Payments for WooCommerce Plugin <= 7.3.11 is vulnerable to Arbitrary File Upload9.1 Critical
- avada website builder, theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +2 moreAvada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- ibm security guardium key lifecycle managerIBM Security Guardium Key Lifecycle Manager file upload8.5 High
- ibm security guardium key lifecycle managerIBM Security Guardium Key Lifecycle Manager file upload4.3 Medium
- apache ofbizApache OFBiz: Path traversal or file inclusion5.3 Medium
- freescout, freescout-helpdesk freescout-helpdesk/freescout +1 moreUnrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout6.1 Medium
- codeastro membership management systemAn Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0...8.8 High
- f-logic datacube3F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an...8.8 High
- libmingA memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to...6.5 Medium
- ctcms project ctcmsCtcms Upsys.php unrestricted upload5.0 Medium
- osuuu lightpictureosuuu LightPicture Setup.php unrestricted upload4.7 Medium
- byzoro smart s42 management platformByzoro Smart S42 Management Platform userattestation.php unrestricted upload4.7 Medium
- myprestamodules simpleimportproduct, product catalog \(csv\, excel\) import +1 moreIn the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from...9.1 Critical
- code-projects student enrollmentAn arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of...9.8 Critical
- bplugins icons font loaderWordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload7.2 High
- joomunited wp media folderWordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload9.9 Critical
- skymoonlabs movetoWordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload10.0 Critical
- sysbasics easy checkout field editor, woocommerce easy checkout field editor, fees & discounts, woocommerce easy checkout field editor +2 moreWordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin <= 3.5.12 is vulnerable to Arbitrary File Upload10.0 Critical
- flusityflusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in...6.5 Medium
- phpgurukul complaint management systemSourceCodester Complaint Management System Lodge Complaint Section register-complaint.php unrestricted upload6.3 Medium
- codeastro membership management systemCodeAstro Membership Management System Add Members Tab unrestricted upload4.7 Medium
- codeastro membership management systemCodeAstro Membership Management System Logo unrestricted upload4.7 Medium
- apache answerApache Answer: Pixel Flood Attack by uploading the large pixel file9.1 Critical
- veritas ediscovery platformA vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application...7.2 High
- skinsoft s-museumSKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in...9.8 Critical
- skinsoft s-museumAn arbitrary file upload vulnerability in the Add Media function of SKINsoft S-Museum v7.02.3...6.1 Medium
- pmb project pmbFile Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to...7.2 High
- novel-plusAn arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1...9.8 Critical
- auntvt timoAn issue in Timo v.2.0.3 allows a remote attacker to execute arbitrary code via the filetype...9.8 Critical
- suite crm crm, salesagility suitecrm +1 moreSuite CRM v7.14.2 - RCE via Local File Inclusion9.9 Critical
- misskeyLack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts7.1 High
- joinmastodon mastodonLack of media type verification of Activity Streams objects allows impersonation of remote accounts8.5 High
- ibm trusteer android sdk, trusteer ios sdk, trusteer android sdk for mobile +1 more +3 moreTrusteer for mobile file upload2.2 Low
- alf, alfio-event alf.io +1 moreCross-Site Scripting (XSS) via File Upload in Alf.io3.5 Low
- dell recoverpoint for virtual machines, recoverpoint for vms +1 moreDell RecoverPoint for Virtual Machines 5.3.x contains an OS Command injection vulnerability. An...7.2 High
- cszcms csz cms, cszcms +1 moreAn arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to...9.8 Critical
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected...8.8 High
- gambioUnrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows...7.8 High
- gambioDeserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary...9.8 Critical
- apache solrApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets8.8 High
- Show moreLoading…