CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- brizy, themefusecom brizy – page builder, brizy brizy-page builder +2 moreBrizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- cisco identity services engine, identity services engine software +1 moreA vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE)...4.7 Medium
- manageengine ddi central, zohocorp manageengine ddi central +1 moreArbitrary file writing5.5 Medium
- apache streampipesApache StreamPipes: Potential remote code execution (RCE) via file upload8.8 High
- keydatas, zhengdon 简数采集器 +1 more简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- code-projects online student management system, online student management system project student management system +1 moreSourceCodester Online Student Management System add-students.php unrestricted upload5.3 Medium
- gitlabUncontrolled Search Path Element in GitLab3.0 Low
- nanjing xingyuantu technology sparkshopFile Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1...9.8 Critical
- oretnom23 simple library management systemSimple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an...9.8 Critical
- brian batt - elearningfreak.com insert or embed articulate content into wordpress, elearningfreak insert or embed articulate content +1 moreInsert or Embed Articulate Content into WordPress < 4.3000000024 - Author+ Arbitrary File Upload8.8 High
- project team tmall demoTmall_demo v2024.07.03 was discovered to contain an arbitrary file upload vulnerability.5.3 Medium
- mini mini-tmall, project team tmall demo +1 moreTmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component...4.9 Medium
- nanjing xingyuantu technology sparkshopNanjing Xingyuantu Technology SparkShop uploadFile unrestricted upload5.3 Medium
- bug library library, unknown bug library +1 moreBug Library < 2.1.1 - Unauthenticated RCE9.1 Critical
- tipsandtricks-hq wp emember, unknown wp-emember +1 moreWP eMember < 10.6.6 - Admin+ Arbitrary File Upload8.8 High
- realtyna organic idx plugin, organic idx +1 moreWordPress Realtyna Organic IDX plugin <= 4.14.13 - Arbitrary File Upload vulnerability9.1 Critical
- spreadsheetconverter import spreadsheets from microsoft excel, import spreadsheets +1 moreWordPress Import Spreadsheets from Microsoft Excel plugin <= 10.1.4 - Arbitrary File Upload vulnerability9.1 Critical
- bestwebsoft quotes and tips, unknown quotes and tips by bestwebsoft +1 moreQuotes and Tips < 1.45 - Admin+ Arbitrary File Upload4.8 Medium
- publiccmsAn arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS...8.8 High
- publiccmsAn arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of...8.8 High
- publiccmsAn arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS...8.8 High
- publiccmsAn arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0...8.8 High
- publiccmsAn arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0...8.8 High
- publiccmsAn arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS...8.8 High
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: File Upload Vulnerability in the Panorama Web Interface7.0 High
- croogoCroogo Setting Theme unrestricted upload5.1 Medium
- advanced file manager shortcodes, advancedfilemanager file manager advanced shortcode +1 moreAdvanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1)....8.7 High
- automattic newspack blocks, newspack newsletters +1 moreWordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability9.9 Critical
- wpzita zita elementor site libraryWordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability9.9 Critical
- andy moyle church admin, church admin project admin +1 moreWordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability9.9 Critical
- rmac0001 iq testimonials, rogermacrae iq-testimonials +1 moreIQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- nikolaystrikhar gutenberg forms, gutenberg forms – wordpress form builder plugin +1 moreGutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload9.8 Critical
- bitapps bit form, bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builder +1 moreBit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- pjgalbraith default thumbnail plusDefault Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- unknown generate pdf using contact form 7WordPress Generate PDF using Contact Form 7 plugin <= 4.1.2 - CSRF to Arbitrary File Upload vulnerability9.6 Critical
- webnus modern events calendar, modern events calendar lite +1 moreModern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- sap enable now[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now3.3 Low
- openvpn, openvpn 2, openvpn2 +2 moreOpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory,...9.8 Critical
- wbolt imgspider, imgspider – 图片采集抓取插件 +1 moreIMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'8.8 High
- wbolt imgspider, imgspider – 图片采集抓取插件 +1 moreIMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'8.8 High
- yt-dlp, ytdl-org youtube-dl +1 moreyt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization7.8 High
- home owners collection management system project owners collection management system, sourcecodester home owners collection management system +1 moreSourceCodester Home Owners Collection Management System unrestricted upload5.3 Medium
- splunk cloud, splunk, splunk cloud platform +1 more +3 moreInsecure File Upload in the indexing/preview REST endpoint4.3 Medium
- changing mobile one time passwordCHANGING Mobile One Time Password - Arbitrary File Upload7.2 High
- machformMachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to...9.9 Critical
- vanna-ai vanna, vanna-ai/vanna +1 moreArbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna9.8 Critical
- bc security empireBC Security Empire Path Traversal RCE9.8 Critical
- lightning-ai lightning-ai/pytorch-lightning, lightning ai ai\/pytorch lightning, lightningai pytorch lightning +2 moreArbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning9.1 Critical
- itsourcecode online food ordering systemitsourcecode Online Food Ordering System addproduct.php unrestricted upload6.9 Medium
- Show moreLoading…