CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- phpgurukul tourism management systemPhpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with...8.8 High
- shibangcommunications ip network intercom broadcasting systemFile Upload vulnerability in Shibang Communications Co., Ltd. IP network intercom broadcasting...8.8 High
- vesystem cloud desktopVesystem Cloud Desktop fileupload2.php unrestricted upload6.3 Medium
- vesystem cloud desktopVesystem Cloud Desktop fileupload.php unrestricted upload6.3 Medium
- ai3 qbibotAi3 QbiBot - Unrestricted File Upload7.2 High
- codoforumAn arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows...7.2 High
- cym1102 nginxwebuicym1102 nginxWebUI upload unrestricted upload4.3 Medium
- opengnsysUnrestricted Upload of File with Dangerous Type vulnerability in OpenGnsys8.8 High
- ai engine project engine, jordy meow ai engine: chatgpt chatbot, meowapps ai engine +2 moreWordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fse, otter blocks +1 moreOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting6.4 Medium
- traccarTraccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution9.7 Critical
- qdrant, qdrant qdrant/qdrant +1 morePath Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant9.8 Critical
- traccarTraccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type8.5 High
- byzoro smart s80 management platform, smart s80 +1 moreByzoro Smart S80 Management Platform userattestation.php unrestricted upload4.7 Medium
- envato template kit – importTemplate Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload6.4 Medium
- dattateccom envíalosimple: email marketing y newsletters, envialosimple email marketing y newsletters, donweb envialosimple +2 moreEnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- wangshen secgate 3600Wangshen SecGate 3600 ?g=net_pro_keyword_import_save unrestricted upload4.7 Medium
- fast5 prison management systemSourceCodester Prison Management System Avatar add-admin.php unrestricted upload6.9 Medium
- fast5 prison management systemSourceCodester Prison Management System Avatar edit-photo.php unrestricted upload6.3 Medium
- andy moyle church admin, church admin project admin +1 moreWordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability9.9 Critical
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerability9.9 Critical
- moove agency import xml and rss feeds, wordpress import xml and rss feeds plugin +1 moreWordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerability7.2 High
- sukhchain singh auto posterWordPress Auto Poster plugin <= 1.2 - Arbitrary File Upload vulnerability9.1 Critical
- anisha car rentalcode-projects Car Rental add-vehicle.php unrestricted upload6.3 Medium
- psi-4ward psitransferPsiTransfer file integrity violation vulnerability6.5 Medium
- psi-4ward psitransferPsiTransfer vulnerable to violation of the integrity of file distribution6.5 Medium
- wordpress, wordpress wordpress-develop +1 morePHP file upload bypass via Plugin installer7.7 High
- reputeinfosystems bookingpress, appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreBookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload7.2 High
- projeqtorprojeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via...8.8 High
- byzoro smart s210 firmwareFile Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent...6.5 Medium
- instawp connectWordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerability9.9 Critical
- themeisle multiple page generator plugin – mpg, multiple page generator +1 moreWordPress Multiple Page Generator Plugin <= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability9.1 Critical
- sem-cms semcmsAn issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code,...9.8 Critical
- lepton-cms leptoncmsFile Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute...8.8 High
- rems image accordion gallery appSourceCodester Image Accordion Gallery App add-image.php unrestricted upload6.3 Medium
- giraphix creative layouts for elementorWordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerability7.5 High
- biplob018 shortcode addonsWordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability9.1 Critical
- quanticalabs chauffeur taxi booking system for wordpressWordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerability10.0 Critical
- ivanti itsm, neurons for itsm +1 moreAn file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to...9.9 Critical
- youdiancmsYouDianCMS ChannelAction.class.php unrestricted upload4.7 Medium
- dimitri grassi salon booking system, salon booking system booking system +1 moreWordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability10.0 Critical
- cubewp, cubewp – all-in-one dynamic content framework, cubewp1211 cubewp – all-in-one dynamic content framework +2 moreWordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability9.9 Critical
- tumult hype animationsWordPress Tumult Hype Animations plugin <= 1.9.12 - Arbitrary File Upload vulnerability9.1 Critical
- jordy meow ai engine: chatgpt chatbot, meowapps ai engine, jordy meow ai-engine chatgpt chatbot +2 moreWordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability9.1 Critical
- mblog project mblogAn issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted...9.8 Critical
- zitadelZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass8.7 High
- wapppress team wapppressWordPress WappPress plugin <= 5.0.3 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- hitachi energy rtu500 series cmu firmwareA vulnerability exists in the stb-language file handling that affects the RTU500 series product...6.8 Medium
- hitachi energy rtu500 series cmu firmwareA vulnerability exists in the stb-language file handling that affects the RTU500 series product...8.2 High
- music gallery site project gallery site, oretnom23 music gallery site +1 moreSourceCodester Music Gallery Site unrestricted upload7.3 High
- Show moreLoading…