CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- renehermi wp staging – wordpress backup, restore & migrationWP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload9.1 Critical
- tcpdf project tcpdftcpdf - security update7.5 High
- dedecmsAn arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file.9.8 Critical
- liveboxcloud vdeskAn issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to…8.8 High
- vtenextVtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper auth…8.1 High
silverstripe/frameworkPackagistsilverstripe/framework allows upload of dangerous file types8.8 High- itsourcecode vehicle management system, sourcecodester vehicle service management system +1 moreSourceCodester Vehicle Management System newvehicle.php unrestricted upload6.9 Medium
- No product listedAn arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF file.5.5 Medium
- brainstormforce custom fonts – host your fonts locally, custom fonts +1 moreCustom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- netgear prosafe network management systemNETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability8.8 High
- dedecmsThere is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS9.8 Critical
- inxeduAn arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.9.8 Critical
- inxedu, inexdu +1 moreAn arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.9.8 Critical
- inxeduAn arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.9.8 Critical
- hashthemes hash form – drag & drop form builder, hash form, drag and drop form builder +2 moreHash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution9.8 Critical
- itsourcecode vehicle management systemSourceCodester Vehicle Management System HTTP POST Request newdriver.php unrestricted upload5.3 Medium
- wangshen secgate 3600Wangshen SecGate 3600 ?g=log_import_save unrestricted upload5.3 Medium
- codezips e-commerce site, ecommerce site +1 moreCodezips E-Commerce Site editproduct.php unrestricted upload5.3 Medium
- lylme spageAn arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5...9.8 Critical
- itsourcecode student management systemSourceCodester Student Management System controller.php unrestricted upload6.9 Medium
- emlog, emlog pro project pro +1 moreEmlog Pro setting.php unrestricted upload5.1 Medium
- activedemand online agency marketing automation activedemandWordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerability10.0 Critical
- joomsky js help desk, js help desk – best help desk & support plugin, jshelpdesk +2 moreWordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerability9.1 Critical
- copymatic, copymatic – ai content writer & generator, ryanfaber copymatic – ai content writer & generator +2 moreWordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- 8theme xstore coreWordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability8.2 High
- sinamjackson schoolwebtechSourceCodester SchoolWebTech home.php unrestricted upload6.9 Medium
- d-link dar-7000-40, dlink dar-7000 firmware +1 moreD-Link DAR-7000-40 urlblist.php unrestricted upload5.3 Medium
- d-link dar-7000-40, dlink dar-7000 firmware +1 moreD-Link DAR-7000-40 url.php unrestricted upload5.3 Medium
- d-link dar-7000-40, dlink dar-7000 firmware +1 moreD-Link DAR-7000-40 resmanage.php unrestricted upload5.3 Medium
- d-link dar-7000-40, dlink dar-7000 firmware +1 moreD-Link DAR-7000-40 onlineuser.php unrestricted upload5.3 Medium
- d-link dar-7000-40, dlink dar-7000 firmware +1 moreD-Link DAR-7000-40 licenseauthorization.php unrestricted upload5.3 Medium
- donbermoy online art gallery management systemSourceCodester Online Art Gallery Management System adminHome.php unrestricted upload5.3 Medium
- mayuri k best courier management systemSourceCodester Best Courier Management System view_parcel.php unrestricted upload5.3 Medium
- oretnom23 simple online bidding systemSourceCodester Simple Online Bidding System unrestricted upload6.9 Medium
- codezips e-commerce siteCodezips E-Commerce Site addproduct.php unrestricted upload5.3 Medium
- oretnom23 employee and visitor gate pass logging system, sourcecodester employee visitor gatepass logging system +1 moreSourceCodester Employee and Visitor Gate Pass Logging System unrestricted upload5.3 Medium
- online discussion forum site project discussion forum site, razormist online discussion forum site +1 moreSourceCodester Online Discussion Forum Site registerH.php unrestricted upload6.9 Medium
drupal/drupalPackagistDrupal Malicious file upload with filenames stating with dotNo scoredrupal/corePackagistDrupal core unrestricted file upload6.6 Medium- byzoro smart s200 management platformByzoro Smart S200 Management Platform userattestation.php unrestricted upload5.3 Medium
- rubinchu r-pan-scaffoldingAn arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to...5.4 Medium
- kykmsAn arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute...5.4 Medium
- dootaskAn arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary...5.4 Medium
- microfocus imanagerFile Upload vulnerability in unauthenticated session found in iManager.5.6 Medium
- microfocus imanagerRemote Code Execution vulnerability in the iManager7.8 High
- gitGit's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution9.1 Critical
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import...7.2 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected...7.2 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected...7.2 High
- sap netweaver, sap se netweaver application server abap and abap platform +1 moreFile upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform9.6 Critical
- Show moreLoading…