CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- shafiq digital lottery, digital library +1 moreWordPress Digital Lottery plugin <= 3.0.5 - Arbitrary File Upload vulnerability10.0 Critical
- limb image gallery, wordpress gallery plugin – limb image gallery +1 moreWordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Upload vulnerability9.9 Critical
- thatplugin iconizeWordPress Iconize plugin <= 1.2.4 - Remote Code Execution (RCE) vulnerability9.1 Critical
- xaraartech external featured image from bingWordPress External featured image from bing plugin <= 1.0.2 - Remote Code Execution (RCE) vulnerability9.9 Critical
- takayuki imanishi acf images search and insertWordPress ACF Images Search And Insert plugin <= 1.1.4 - Arbitrary File Upload vulnerability9.9 Critical
- denis azz anonim postingWordPress Azz Anonim Posting plugin <= 0.9 - Arbitrary File Upload vulnerability10.0 Critical
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- najeebmedia frontend file manager, n-media post front-end form, post front-end form +1 more +3 moreFrontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload9.8 Critical
- file manager pro, filemanagerpro file manager, file manager pro +2 moreFile Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload7.5 High
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload9.8 Critical
- file manager pro, filemanagerpro file manager, file manager pro +2 moreFile Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload7.4 High
- quadlayers quadmenu – mega menu, wordpress mega menu-quadmenu +1 moreWordPress Mega Menu <= 2.0.6 - Arbitrary File Creation9.8 Critical
- classcmsClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which...9.8 Critical
- rems drag and drop image uploadSourceCodester Drag and Drop Image Upload upload.php unrestricted upload5.3 Medium
- ragic enterprise cloud databaseRagic Enterprise Cloud Database - Arbitrary File Upload10.0 Critical
- formosasoft ee-class, ee class +1 moreFormosaSoft ee-class - Local File Inclusion8.8 High
- dycmsFile Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to...9.8 Critical
- wanxingtechnology yitu project management kirin editionAn issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote...9.8 Critical
- 07fly 07flycms, zero takeoff 07fly-cms, 07flycrm +1 more +3 more07FLYCMS/07FLY-CMS/07FlyCRM pictureUpload unrestricted upload5.1 Medium
- 07fly 07flycms, zero takeoff 07fly-cms, 07flycrm +1 more +3 more07FLYCMS/07FLY-CMS/07FlyCRM fileUpload unrestricted upload5.1 Medium
- 07fly 07fly-cms, 07flycms, customer relationship management +2 more07FLYCMS/07FLY-CMS/07FlyCRM Module Plug-In sysmodule_1 uploadFile unrestricted upload5.1 Medium
- zhejiang university entersoft customer resource managementAn arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang...9.8 Critical
- angular-base64-upload-project angular-base64-uploadangular-base64-upload vulnerable to unauthenticated remote code execution9.8 Critical
- codezips tourist management systemCodezips Tourist Management System change-image.php unrestricted upload5.1 Medium
- codezips tourist management systemCodezips Tourist Management System create-package.php unrestricted upload5.1 Medium
- campcodes online shopping portal, online shopping portal project shopping portal +1 moreCodezips Online Shopping Portal update-image1.php unrestricted upload5.3 Medium
- adobe framemakerAdobe Framemaker | Unrestricted Upload of File with Dangerous Type (CWE-434)7.8 High
- adobe indesign, indesign desktop +1 moreInDesign Desktop | Unrestricted Upload of File with Dangerous Type (CWE-434)7.8 High
- adobe incopyInCopy | Unrestricted Upload of File with Dangerous Type (CWE-434)7.8 High
- laravel livewireLivewire Remote Code Execution (RCE) on File Uploads7.7 High
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform (web intelligence) +1 moreInsecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)7.7 High
- bit apps form, bitapps bit form +1 moreWordPress Bit Form plugin <= 2.13.10 - Arbitrary File Upload vulnerability8.0 High
- hashthemes hash form – drag & drop form builder, hash form +1 moreHash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload6.1 Medium
- bitapps file managerBit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload6.8 Medium
- shilpi computers client dashboardUnrestricted File Upload Vulnerability8.6 High
- fileorganizer, softaculous fileorganizer – wordpress file manager +1 moreFileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- emiloimagtolis online discussion forum, online discussion forum project discussion forum +1 moreFile Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote...8.8 High
- emiloimagtolis online discussion forum, online discussion forum project discussion forum +1 moreFile Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote...8.8 High
- thimpress wp hotel bookingWP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- contaoDuplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript6.4 Medium
- octobercms octoberOctober allows an admin account to upload PDF containing malicious JavaScript4.7 Medium
- tribalsystems zenarioZenario allows authenticated admin users to upload PDF files containing malicious code4.8 Medium
- librenmsLibreNMS Contains a Stored XSS via File Upload4.6 Medium
- xunhuweb wechat social login, wechat social login 微信qq钉钉登录插件 +1 moreWechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- kalvingit kvf-adminkalvinGit kvf-admin FileUploadKit.java fileUpload unrestricted upload5.1 Medium
- huankemao scrmHuankeMao SCRM Administrator Backend WxkConfig.php upload_domain_verification_file unrestricted upload5.1 Medium
- kacins ypayAn arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code...8.8 High
- agnaiAgnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal8.8 High
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload6.8 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- Show moreLoading…