CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- sojweb soj soundslidesSoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- aspengrovestudios inline image upload for bbpressInline Image Upload for BBPress <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- invoiceplaneInvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code...9.8 Critical
- bizerba se & co. kg gt-softcontrolUnrestricted Fileupload6.6 Medium
- aureus erpDigiwin ERP UploadAjaxAPI.ashx unrestricted upload5.3 Medium
- kentico xperienceKentico Xperience stored cross-site scripting in multiple-file upload functionality6.1 Medium
- kentico xperienceKentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE7.2 High
- aureus erpDigiwin ERP FileUploadApi.ashx DoWebUpload unrestricted upload6.9 Medium
- softwin wmx3Softwin WMX3 ImageAdd.ashx ImageAdd unrestricted upload5.3 Medium
- phpgurukul elearning systemPHPGurukul eLearning System Image index.php unrestricted upload5.3 Medium
- yue lao blind box 月老盲盒Yue Lao Blind Box 月老盲盒 Upload.php base64image unrestricted upload5.3 Medium
- phplaozhang lzcms-laozhangbokexitongphplaozhang LzCMS-LaoZhangBoKeXiTong HTTP POST Request upimage.html unrestricted upload5.3 Medium
- mayurik best church management softwareSourceCodester Best Church Management Software soulwinning_crud.php unrestricted upload5.3 Medium
- composio, composiohq composiohq/composio +1 moreUnrestricted File Write and Read in composiohq/composio7.2 High
- parisneo parisneo/lollms-webui, lollms web ui +1 moreUnrestricted File Upload and Execution in parisneo/lollms-webui6.6 Medium
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt9.1 Critical
- lightning-ai lightning-ai/pytorch-lightning, lightningai pytorch lightning +1 moreArbitrary File Write/Overwrite in lightning-ai/pytorch-lightning9.1 Critical
- martmbithi ibankingAn arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers...9.8 Critical
- file away project away, thomstark file away +1 moreFile Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function9.8 Critical
- ibm security reaqta, security qradar edr +1 moreIBM Security ReaQta file upload4.7 Medium
- emlogAn arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0...6.3 Medium
- glpi-project glpiGLPI allows authenticated remote code execution8.6 High
- sytel softdial contact centerUnrestricted file upload vulnerability in Softdial Contact Center8.7 High
- soplanningA file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload...9.8 Critical
- apple ipados, macos, tvos +4 more +6 moreA logic issue was addressed with improved file handling. This issue is fixed in visionOS 2.2,...8.8 High
- e-excellence u-office forcee-Excellence U-Office Force - Arbitrary File Upload8.8 High
- iroad dash cam fx2, iroadau fx2 firmware +1 moreIROAD Dash Cam FX2 upload_file unrestricted upload5.3 Medium
- flowiseFlowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint9.3 Critical
- lovecards, lovecards lovecardsv2 +1 moreLoveCards LoveCardsV2 image unrestricted upload6.9 Medium
- zzskzy warehouse refinement management systemzzskzy Warehouse Refinement Management System SaveCrash.ashx UploadCrash unrestricted upload5.3 Medium
- theme egg themeegg toolkitWordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability9.1 Critical
- joomla! project cms[20250301] - Core - Malicious file uploads via Media Manager7.1 High
- zzskzy warehouse refinement management systemzzskzy Warehouse Refinement Management System AcceptZip.ashx ProcessRequest unrestricted upload5.3 Medium
- tychesoftwares product input fields for woocommerceProduct Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload8.1 High
- coderevolution aiomatic, aiomatic - automatic ai content writer & editor, gpt-3 & gpt-4, chatgpt chatbot & ai toolkit +1 moreAiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload8.8 High
- bestweblayout smtp by bestwebsoft, bestwebsoft smtp +1 moreSMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- s-a-zhd ecommerce-website-using-phps-a-zhd Ecommerce-Website-using-PHP customer_register.php unrestricted upload5.3 Medium
- 1000mz chestnutcmsChestnutCMS upload uploadFile unrestricted upload5.3 Medium
- publiccmsAn arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of...9.8 Critical
- redaxoREDAXO allows Arbitrary File Upload in the mediapool page5.4 Medium
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330...8.8 High
- axis os, os 2024 +1 moreGirishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API...3.5 Low
- flowiseai flowiseFlowiseAI Flowise arbitrary file upload vulnerability9.8 Critical
- shishuocms project shishuocmsshishuocms ManageUpLoadAction.java handleRequest unrestricted upload5.3 Medium
- osuuu lightpictureosuuu LightPicture Api.php upload unrestricted upload5.3 Medium
- zframeworks zzzj1983 zz resolve unrestricted upload5.3 Medium
- zframeworks zzzj1983 zz ZfileAction.upload unrestricted upload5.3 Medium
- skycaijiZorlan SkyCaiji Tool.php fileAction unrestricted upload5.3 Medium
- wp swings woocommerce ultimate gift cardWooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- shopxoShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.9.8 Critical
- Show moreLoading…