CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- element-hq synapseSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders8.2 High
- ibm cognos controllerIBM Cognos Controller file upload8.0 High
- ibm cognos controllerIBM Cognos Controller file upload5.5 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- No product listedAn authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of...8.8 High
- stefan bohacek fediverse embedsWordPress Fediverse Embeds plugin <= 1.5.3 - Arbitrary File Upload vulnerability10.0 Critical
- coalescent systems freepbxAn authenticated arbitrary file upload vulnerability in the component /module_admin/upload.php of...2.2 Low
- interinfo dreammakerInterinfo DreamMaker - Unrestricted File Upload through Path Traversal9.8 Critical
- guizhou xiaoma technology jpressGuizhou Xiaoma Technology jpress Avatar upload cross site scripting5.3 Medium
- pathomationWordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerability10.0 Critical
- tumult hype animations, tumultinc tumult hype animations +1 moreTumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function9.9 Critical
- ninjateam file manager pro – filester, filester, filemanager pro-filester +2 moreFile Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- wpdevart booking calendar, appointment booking system, booking calendar +1 moreBooking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload7.2 High
- spipAn authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3...6.3 Medium
- codeastro hospital management system, hospital management system project management system +1 moreCodeAstro Hospital Management System his_doc_update-account.php unrestricted upload5.3 Medium
- codezips free exam hall seating management systemCodezips Free Exam Hall Seating Management System Profile Image profile.php unrestricted upload5.3 Medium
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management <= 91.5.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- dasinfomedia wpgym - wordpress gym management system, mojoomla wordpress gym management system, dasinfomedia wpgym gym management system +2 moreWPGYM <= 67.1.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload8.8 High
- automated logic webctrl, carrier i-vu +1 moreAutomated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload10.0 Critical
- omegatAn arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows...9.8 Critical
- gelcon modbusmechanicAn arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute...8.8 High
- django cms association filerFile Upload Bypass in django Filer5.5 Medium
- dedebizAn arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0...7.2 High
- hkcmsHkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common...9.8 Critical
- phpgurukul boat booking systemFile Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0...7.2 High
- markusproject markusArbitrary File Write leading up to remote code execution (instructor accounts)7.1 High
- markusproject markusMarkUs Arbitrary File Write leading up to remote code execution (student accounts)7.1 High
- anton hoelstad wp quick setupWordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability9.9 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- davor zeljkovic convert docx2postWordPress Convert Docx2post plugin <= 1.4 - Arbitrary File Upload vulnerability9.1 Critical
- halyra cdiWordPress CDI plugin <= 5.5.3 - Arbitrary File Upload vulnerability9.1 Critical
- clarisse k. writer helperWordPress Writer Helper plugin <= 3.1.6 - Arbitrary File Upload vulnerability9.9 Critical
- subhasis laha gallerioWordPress Gallerio plugin <= 1.01 - Arbitrary File Upload vulnerability9.9 Critical
- saad iqbal user managementWordPress User Management plugin <= 1.1 - Arbitrary File Upload vulnerability9.9 Critical
- bigfive cf7 reply manager, contact form 7 +1 moreWordPress CF7 Reply Manager plugin <= 1.2.3 - Arbitrary File Upload vulnerability9.9 Critical
- bikram joshi b-banner sliderWordPress B-Banner Slider plugin <= 1.1 - Arbitrary File Upload vulnerability9.9 Critical
- wibergs web csv to html, cvs to html +1 moreWordPress CSV to html plugin <= 3.26 - Arbitrary File Upload vulnerability9.9 Critical
- basepress migration tools, codesavory basepress migration tools +1 moreWordPress BasePress Migration Tools plugin <= 1.0.0 - Arbitrary File Upload vulnerability9.9 Critical
- pushassist push notifications for wordpress by pushassist, push notifications +1 moreWordPress Push Notifications for WordPress by PushAssist plugin <= 3.0.8 - Arbitrary File Upload vulnerability9.9 Critical
- revmakx backup and staging by wp time capsuleBackup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload9.8 Critical
- creativeinteractivemedia real3d flipbook, real 3d flipbook – 3d flipbook, pdf flipbook, pdf viewer, pdf embedder +1 moreReal3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Upload8.8 High
- geeeeeeeek java shopA file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by...4.3 Medium
- optimal access kbucketWordPress KBucket plugin <= 4.2.2 - Arbitrary File Upload vulnerability9.9 Critical
- hive support support, hivesupport hive support +1 moreWordPress Hive Support – WordPress Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin <= 1.1.1 - Arbitrary File Upload vulnerability9.9 Critical
- webtechglobal easy csv importer betaWordPress Easy CSV Importer plugin <= 7.0.0 - Arbitrary File Upload vulnerability10.0 Critical
- Show moreLoading…