CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- ka-yue auto featured image, auto-featured-image project auto-featured-image +1 moreAuto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- progress whatsup goldWhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability8.8 High
- avaya ip officeAvaya IP Office One-X Portal File Upload Vulnerability9.9 Critical
- farcryAn arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry...9.8 Critical
- instawp connectWordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability10.0 Critical
- bluditBludit - Remote Code Execution (RCE) through Image API8.9 High
- bluditBludit - Remote Code Execution (RCE) through File API8.9 High
- oretnom23 simple online bidding systemSourceCodester Simple Online Bidding System unrestricted upload5.3 Medium
- bogdan bendziukov squeezeWordPress Squeeze plugin <= 1.4 - Arbitrary File Upload vulnerability9.1 Critical
- adminer, adminerevo +1 moreAdminer and AdminerEvo vulnerable to directory traversal and file upload9.2 Critical
- metaventis edu-sharingUnrestricted Upload of Files in edu-sharing7.4 High
- spring by vmware tanzu cloud skipperArbitrary File Write Vulnerability in Spring Cloud Data Flow8.8 High
- raajtram pexels, pexels: free stock photos +1 morePexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- sirv image optimizer, resizer and cdn – sirv, sirv, sirv image optimizer\, resizer and cdn +2 moreImage Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload9.9 Critical
- salonbookingsystem salon booking system, wordpresschef salon booking system – free version +1 moreSalon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- ali2woo aliexpress dropshipping with alinext, aliexpress dropshipping plugin for woocommerce & wordpress +1 moreAliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- prestashop helpdeskIn the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0...10.0 Critical
- prestashopmodules jamarketplaceIn the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop,...9.8 Critical
- clive 21 simple online hotel reservation systemitsourcecode Simple Online Hotel Reservation System edit_room.php unrestricted upload6.9 Medium
- clive 21 simple online hotel reservation systemitsourcecode Simple Online Hotel Reservation System add_room.php unrestricted upload6.9 Medium
- itsourcecode monbela tourist inn online reservation systemitsourcecode Monbela Tourist Inn Online Reservation System controller.php unrestricted upload6.9 Medium
- itsourcecode magbanua beach resort online reservation systemitsourcecode Magbanua Beach Resort Online Reservation System controller.php unrestricted upload6.9 Medium
- itsourcecode pool of bethesda online reservation systemitsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload6.9 Medium
- dolibarr erp\/crmDolibarr arbitrary file upload vulnerability8.8 High
- phpvibePHPVibe Media Upload Page upload-mp3.php unrestricted upload5.3 Medium
- oretnom23 payroll management systemSourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload...9.8 Critical
- asus dsl-ac51, dsl-ac52, dsl-ac52u +23 more +25 moreASUS Router - Upload arbitrary firmware9.8 Critical
- asus download masterASUS Download Master - Arbitrary File Upload7.2 High
- verint wfo, workforce optimization +1 moreVerint - CWE-434: Unrestricted Upload of File with Dangerous Type8.8 High
- adobe commerce, commerce webhooks, magento +2 moreRCE in the Adobe Commerce Webhook module through a legit webhook definition7.2 High
- openeclass, gunet open eclass platform +1 moreFile Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary...9.8 Critical
- jan syski megabipArbitrary File Upload in MegaBIP9.3 Critical
- sap document builderUnrestricted file upload in SAP Document Builder (HTTP service)6.5 Medium
- salesagility suitecrmSuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution9.1 Critical
- asghar hatampoor buddypress cover, buddypress cover project cover +1 moreWordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerability10.0 Critical
- ibm engineering lifecycle optimization publishingIBM Engineering Lifecycle Optimization Publishing file upload6.5 Medium
typo3/cmsPackagistTYPO3 Arbitrary Code Execution via File List Module8.8 High- bakery online ordering system project online ordering system, itsourcecode bakery online ordering system +1 moreitsourcecode Bakery Online Ordering System unrestricted upload6.9 Medium
- itsourcecode online discussion forum, online discussion forum project discussion forum +1 moreitsourcecode Online Discussion Forum poster.php unrestricted upload5.3 Medium
- monstra, monstra cms +1 moreAn arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute...7.2 High
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreUnrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgpt6.5 Medium
- homebrew janJan path traversal vulnerability9.8 Critical
- homebrew janJan path traversal vulnerability9.8 Critical
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates), unlimited-elements unlimited elements for elementor +2 moreWordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerability9.1 Critical
- brian batt - elearningfreak.com insert or embed articulate content into wordpress, elearningfreak insert or embed articulate content +1 moreInsert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCE5.4 Medium
- zyxel nas326 firmware, nas542 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program ...9.8 Critical
- ivanti avalancheAn unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x...7.2 High
- ivanti itsm, neurons for itsm +1 moreAn unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a...8.7 High
typo3/cms-corePackagistTYPO3 Arbitrary Code Execution via File List Module8.8 High- emiloimagtolis online discussion forumitsourcecode Online Discussion Forum change_profile_picture.php unrestricted upload5.3 Medium
- Show moreLoading…