CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- sh1zen multi uploader for gravity formsWordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability9.0 Critical
- enrico sandoli smallerik file browserWordPress Smallerik File Browser plugin <= 1.1 - Arbitrary File Upload vulnerability9.9 Critical
- quantumcloud wpbot pro wordpress chatbot, wpbot wpot +1 moreWPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload9.8 Critical
- dmitry v. (ceo of "ukr solution") barcode scanner with inventory & order managerWordPress Barcode Scanner and Inventory manager plugin <= 1.6.7 - Arbitrary File Upload vulnerability9.1 Critical
- radykal fancy product designerWordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerability9.0 Critical
- itsourcecode farm management system, angeljudesuarez tailoring management system +1 moreitsourcecode Farm Management System add-pig.php unrestricted upload5.1 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager — ultimate wordpress file manager and document library plugin +1 moreAdvanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- t2bot matrix-media-repoUntrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media Repo6.8 Medium
- pmb services platform, sigb pmb +1 moreInformation exposure vulnerability in PMB platform7.5 High
- pmb services platform, sigb pmb +1 moreUnrestricted Upload of File with Dangerous Type vulnerability in PMB platform9.9 Critical
- nmedia admin and customer messages after order for woocommerce: orderconvoAdmin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting5.4 Medium
- themesbrand chatviaAn issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via...4.6 Medium
- web ready now wr price list manager for woocommerceWordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Remote Code Execution (RCE) vulnerability9.9 Critical
- No product listedAn arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker...6.5 Medium
- ivanti endpoint managerInsufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and...7.8 High
- 51mis lingdang crmShanghai Lingdang Information Technology Lingdang CRM index.php unrestricted upload5.3 Medium
- No product listedBlog Botz for Journal Theme blog_add unrestricted upload6.9 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function8.8 High
- sap se netweaver as java (user admin application)Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application)4.8 Medium
- huayi-tec jeewmsAn arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01...8.1 High
- gestioipAn issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file...9.8 Critical
- venki supravizio bpmVenki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload...9.9 Critical
- seling visual access managerAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated...6.5 Medium
- 1902756969 reggie1902756969 reggie CommonController.java upload unrestricted upload5.3 Medium
- starsea99 starsea-mallStarSea99 starsea-mall uploadController.java UploadController unrestricted upload5.1 Medium
- hcl software dryice myxalyticsHCL MyXalytics is affected by a malicious file upload vulnerability1.6 Low
- atheosImproper Path Validation Enables Path Traversal in Multiple Components in Atheos9.4 Critical
- redaxoAn arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows...7.2 High
- jumpdemand 4ecps web formsWordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability10.0 Critical
- code-projects content management systemcode-projects Content Management System Publish News Page publishnews.php unrestricted upload5.1 Medium
- iocharger firmware for ac modelsWhen uploading new firmware, a shell script inside a firmware file is executed during its processing. This can be used to craft a custom firmware file with a custom script with arbitrary code, which w…9.3 Critical
- iocharger firmware for ac modelsAuthenticated arbitrary file upload to /tmp/ and /tmp/upload/5.3 Medium
- iocharger firmware for ac modelsA backup can be manipulated and then restored to create arbitrary files inside the <redacted> directory. A CGI script can be added to the web directory this way, allowing for full remote code executio…9.3 Critical
- campcodes computer laboratory management systemCampCodes Computer Laboratory Management System edit unrestricted upload5.3 Medium
- code-projects online bike rental systemcode-projects Online Bike Rental System Change Image unrestricted upload5.3 Medium
- singmr houserentSingMR HouseRent AddHouseController.java upload unrestricted upload5.3 Medium
- donglight bookstore, bookstore电商书城系统说明 +1 moredonglight bookstore电商书城系统说明 AdminBookController. java uploadPicture unrestricted upload5.1 Medium
- wander-chu springboot-blogwander-chu SpringBoot-Blog Admin Attachment AttachtController.java upload unrestricted upload5.1 Medium
- zerowdd myblogZeroWdd myblog uploadController.java upload unrestricted upload5.3 Medium
- stonith404 pingvin-shareArbitrary File Overwrite via HTTP POST in Pingvin Share9.8 Critical
- chief gnome garden gnome packageGarden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload8.8 High
- wpchill modula image gallery, modula image gallery – photo grid & video gallery +1 moreModula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload8.8 High
- labredescefetrj wegiaWeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)10.0 Critical
- labredescefetrj wegiaWeGIA has a Cross-Site Scripting (XSS) in File Upload Field8.3 High
- oxygenz clipbucket, macwarrior clipbucket-v5 +1 moreClipBucket V5 Playlist Cover File Upload to Remote Code Execution9.8 Critical
- themeglow jobboard job listingWordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability10.0 Critical
- No product listedAn authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3...8.8 High
- No product listedAn issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading...9.8 Critical
- zhenfeng13 my-blogzhenfeng13 My-Blog uploadController. java upload unrestricted upload5.3 Medium
- zhenfeng13 my-blogzhenfeng13 My-Blog BlogController.java uploadFileByEditomd unrestricted upload5.3 Medium
- Show moreLoading…