CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- proudmubai gofilmProudMuBai GoFilm FileController.go SingleUpload unrestricted upload5.3 Medium
- wpchill modula image gallery, image gallery – photo grid & video gallery +1 moreModula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition7.5 High
- mauticGrapesJsBuilder File Upload allows all file uploads8.8 High
- brainstormforce suremail – smtp and email logs plugin with amazon ses, postmark, and other providersSureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload8.1 High
- evershopEverShop 2.0.1 allows an unauthenticated user to upload files and create directories within the ...7.5 High
- moxi159753 mogu blog v2, mogublog project mogublog +1 moremoxi159753 Mogu Blog v2 pictures unrestricted upload5.3 Medium
- hcltech unicaFile upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.6.3 Medium
- blubrry powerpress podcasting plugin by blubrryBlubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'8.8 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Upload (patch_contents.php)9.9 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Upload (upgrade_contents.php)9.9 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Upload (status_contents.php)9.2 Critical
- soportecibeles ai feedsAI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload9.8 Critical
- soportecibeles cibeles aiCIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload9.8 Critical
- ov3rkll projectlistProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload7.2 High
- beijing star-net ruijie network technology co., ltd. nbr series routersRuijie Networks NBR Routers Unauthenticated Arbitrary File Upload via fileupload.php9.3 Critical
- code-projects online bidding systemcode-projects Online Bidding System addcategory.php categoryadd unrestricted upload5.1 Medium
- projectworlds can pass malicious payloads, advanced library management system +1 moreprojectworlds can pass malicious payloads add_book.php unrestricted upload5.3 Medium
- ashraf-kabir travel-agencyashraf-kabir travel-agency customer_register.php unrestricted upload5.3 Medium
- oc3dots s2b ai assistant – chatbot, ai agents, chatgpt api, image generatorS2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload7.2 High
- appsbd vitepos – point of sale (pos) for woocommerceVitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution8.8 High
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- bww url image importerURL Image Importer <= 1.0.6 - Authenticated (Author+) Arbitrary File Upload8.8 High
- narkom communication and software technologies trade ltd. co. pyxis signageArbitrary File Upload in Narkom Communication Technologies' Pyxis Signage7.2 High
- campcodes retro basketball shoes online storeCampcodes Retro Basketball Shoes Online Store admin_product.php unrestricted upload5.1 Medium
- campcodes retro basketball shoes online storeCampcodes Retro Basketball Shoes Online Store admin_football.php unrestricted upload5.1 Medium
- homarrHomarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload8.1 High
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php9.3 Critical
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.php9.3 Critical
- audiocodes fax server, audiocodes limited fax/ivr appliance, audiocodes interactive voice response +2 moreAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.php6.9 Medium
- egovframework/egovframe-common-componentseGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints6.9 Medium
- unknown waveplayerWavePlayer < 3.8.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- iest winplusStored Cross-Site Scripting (XSS) in WinPlus by Informática del Este8.7 High
- metz connect energy-controlling ewio2-m, energy-controlling ewio2-m-bm, ethernet-io ewio2-bm +3 more +5 morePossible arbitrary file upload8.8 High
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass8.8 High
- nazsabuz wp dropzoneWP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- genetechproducts pie forms — drag & drop form builderPie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload8.1 High
- gravity forms formsGravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload8.1 High
- dzzofficeDzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php...9.8 Critical
- dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware, mozart dds next 2000 firmware +19 more +21 moreThe Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an...9.8 Critical
- dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware, mozart dds next 2000 firmware +19 more +21 moreThe Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an...7.2 High
- iqbolshoh php-business-websiteIqbolshoh php-business-website about.php unrestricted upload5.1 Medium
- testmanagement qatraqQaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment"...8.8 High
- jinher oaJiusi OA OfficeServer unrestricted upload5.3 Medium
- bdtask flight booking softwareBdtask Flight Booking Software Edit Profile edit unrestricted upload5.3 Medium
- No product listedDouPHP file.class.php unrestricted upload5.1 Medium
- bdtask news365Bdtask/CodeCanyon News365 profile unrestricted upload5.1 Medium
- alagaai s-cw2503c-h firmwareA vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware...6.8 Medium
- angeljudesuarez online voting systemitsourcecode Online Voting System index.php unrestricted upload5.3 Medium
- lenovo scanner proAn arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an...7.7 High
- apache ofbizApache OFBiz: Critical Remote Command Execution via Unrestricted File Upload7.3 High
- Show moreLoading…