CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- 1000mz chestnutcmsFile Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was...9.8 Critical
- wangl1989 mysiteformewangl1989 mysiteforme LocalUploadServiceImpl upload unrestricted upload5.1 Medium
- zerowdd studentmanagerZeroWdd studentmanager TeacherController. java editTeacher unrestricted upload5.3 Medium
- zerowdd studentmanagerZeroWdd studentmanager StudentController. java editStudent unrestricted upload5.3 Medium
- campcodes project management systemCampcodes Project Management System update_forms.php unrestricted upload5.3 Medium
- optimizely cmsAn issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity...8.0 High
- No product listedAn arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0...9.8 Critical
- beee acf city selectorWordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability6.6 Medium
- ludwig you wpmastertoolkitWordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability9.1 Critical
- No product listedHuang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a ...10.0 Critical
- azzaroco wp superbackupWordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- taisan tarzan-cmstaisan tarzan-cms Article Management UploadController.java UploadResponse unrestricted upload5.3 Medium
- kovah linkaceFile Upload Vulnerability Leading to XSS in LinkAce v1.15.57.6 High
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA add_achievement_details.php unrestricted upload5.3 Medium
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA update_ach.php unrestricted upload5.3 Medium
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA update_pd_process.php unrestricted upload5.3 Medium
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA add_personal_details.php unrestricted upload5.3 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by file writing vulnerability, successful exploitation could...6.3 Medium
- designinvento directorypress, directorypress – business directory and classified ad listing +1 moreDirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting5.4 Medium
- ibm cognos analyticsIBM Cognos Analytics file upload8.0 High
- tibbo aggregate network managerTibbo AggreGate Network Manager Unrestricted Upload of File with Dangerous Type8.7 High
- sunnet technology co., ltd. corporate training management systemSUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type9.4 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability9.9 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability9.9 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability9.1 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability9.9 Critical
- raisecom msg1200 firmware, msg2100e firmware, msg2200 firmware +1 more +3 moreA vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component...6.3 Medium
- seedprod llc proWordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerability9.1 Critical
- suiteplugins video & photo gallery for ultimate memberWordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.0 - Arbitrary File Upload vulnerability9.9 Critical
- invoiceplaneInvoicePlane 1 upload_file unrestricted upload5.3 Medium
- aruphash crafthemes demo importCrafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files7.2 High
- sidngr import export for woocommerceWordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability9.9 Critical
- azzaroco super backup & clone - migrate for wordpressSuper Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload9.8 Critical
- inspireui mstore api – create native android & ios apps on the cloud, mstore api +1 moreMStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)5.4 Medium
- halfdata opt-in downloadsOpt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- apple macosThe issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2,...5.5 Medium
- apache strutsApache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks9.5 Critical
- image access gmbh scan2netOS Command Execution through Arbitrary File Upload7.2 High
- genetech pie register premium, genetechsolutions pie register +1 moreWordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability10.0 Critical
- lopalopa e-learning management systemKashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File...9.8 Critical
- digi connectport lts firmwareAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload...8.0 High
- roninwp revyWordPress Revy plugin <= 1.18 - Unauthenticated Arbitrary File Upload vulnerability10.0 Critical
- posimyth wdesignkitWordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerability6.6 Medium
- blazethemes pubnewsPubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation8.8 High
- 1000projects online notice board, kashipara online notice board system +1 morecode-projects Online Notice Board Profile Picture registration.php unrestricted upload6.9 Medium
- abb matrix series, nexus series, aspect-ent-12 firmware +20 more +22 moreDangerous File Upload8.7 High
- zoo-project, zoo project zoo +1 moreArbitrary file download in Zoo-Project Echo Example8.7 High
- convert forms project forms, tassos.gr convert forms component for joomla, tassosgr convert forms +2 moreExtension - tassos.gr - Unrestricted file upload in Convert Forms component for Joomla < 4.4.89.8 Critical
- ibm cognos controllerIBM Cognos Controller file upload5.5 Medium
- Show moreLoading…