CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- draytek vigor165 firmware, vigor166 firmware, vigor2133 firmware +17 more +19 moreAn issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8,...8.4 High
- draytek vigor165 firmware, vigor166 firmware, vigor2133 firmware +17 more +19 moreAn issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior...8.8 High
- sma www.sunnyportal.comSMA: Sunny Portal Remote Code Execution6.5 Medium
- foxcmsAn arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS...9.8 Critical
- jizhicmsAn arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2...9.8 Critical
- emlogAn arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3...9.8 Critical
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion9.8 Critical
- aureus erpLumsoft ERP ASPX File UploadAjaxAPI.ashx unrestricted upload6.9 Medium
- yitechnology yi car dashcam firmwareImproper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file...9.8 Critical
- mayurik best church management softwareSourceCodester Best Church Management Software asset_crud.php unrestricted upload5.3 Medium
- mayurik best employee management systemSourceCodester Best Employee Management System Profile Picture unrestricted upload5.1 Medium
- janobe e-learning systemSourceCodester E-Learning System List of Lessons Page index.php unrestricted upload5.1 Medium
- notfound chaty proWordPress Chaty Pro Plugin <= 3.3.3 - Arbitrary File Upload vulnerability10.0 Critical
- wpvivid backup \& migration, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file7.2 High
- hzmanyun education and training systemhzmanyun Education and Training System saveImage unrestricted upload6.9 Medium
- kodeshpa simplifiedWordPress Simplified Plugin Plugin <= 1.0.6 - Arbitrary File Upload vulnerability10.0 Critical
- learning digital orca hcmLearning Digital Orca HCM - Arbitrary File Upload8.8 High
- needyamin library card systemneedyamin Library Card System Add Picture signup.php unrestricted upload6.9 Medium
- schneider electric asco 5310 single-channel remote annunciator, asco 5350 eight channel remote annunciator +1 moreCWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render...7.2 High
- q-free maxtimeA CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q...4.9 Medium
- brizy, themefusecom brizy – page builder +1 moreBrizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads9.9 Critical
- cleantalk login security, firewall, malware removal by cleantalk, security \& malware scan +1 moreSecurity & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload9.8 Critical
- allimages all-images.ai – ia image bank and custom image creationAll-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- wattsense bridgeAuthenticated Arbitrary Python File Upload via Plugin Manager8.8 High
- amini7 zarinpal paid downloadZarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload4.8 Medium
- remyandrade food menu managerSourceCodester Food Menu Manager update.php unrestricted upload5.3 Medium
- aureus erpLumsoft ERP FileUploadApi.ashx DoWebUpload unrestricted upload6.9 Medium
- chimpstudio wp foodbakeryWP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- beian.miit cool-admin-javaAn arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0...7.2 High
- No product listedAn arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows...7.3 High
- fabian shopping portalIn Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload...8.8 High
- autonomy openplcCVE-2025-10669.8 Critical
- cockpit-hq cockpit-hq/cockpitCockpit Arbitrary File Upload8.7 High
- kleor contact managerContact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload8.1 High
- checkmk nagvisCheckmk NagVis Remote Code Execution7.2 High
- advantive veracoreAdvantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to...9.9 Critical
- 1000mz chestnutcmsChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.9.8 Critical
- broadcom symantec privileged access managementThis vulnerability allows a high-privileged authenticated PAM user to achieve remote command...8.8 High
- thecontrolgroup voyagerDevDojo Voyager Arbitrary File Write4.3 Medium
- tandoor recipesTandoor Recipes - Stored XSS through Unrestricted File Upload8.7 High
- themerex addonsThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data9.8 Critical
- needyamin image gallery, image gallery management system +1 moreneedyamin image_gallery Cover Image gallery.php unrestricted upload5.1 Medium
- iqonic wpbookitWPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload9.8 Critical
- joeybling bootplusJoeyBling bootplus SysFileController.java unrestricted upload5.3 Medium
- themefic tourficWordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability9.1 Critical
- ibm planning analytics, planning analytics local +1 moreIBM Planning Analytics file upload8.0 High
- ibm planning analytics, planning analytics local +1 moreIBM Planning Analytics file upload8.0 High
- xerox workplace suiteArbitrary file upload, deletion and read through header manipulation7.6 High
- innovative solutions user filesWordPress user files plugin <= 2.4.2 - Arbitrary File Upload vulnerability10.0 Critical
- ngoccode wp load galleryWordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability9.1 Critical
- Show moreLoading…