CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- pagekitPagekit CMS is vulnerable to OS Command Injection via Storage component9.9 Critical
- c4illin convertxConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution8.8 High
- blackcat-cms blackcat cmsBlackcat CMS 1.4 Remote Code Execution via Jquery Plugin Manager8.6 High
- grabaperch perchPerch CMS 3.2 Remote Code Execution via Unrestricted File Upload8.6 High
- webutlerWebutler v3.2 Remote Code Execution via Arbitrary File Upload8.6 High
- creativeitem academy lmsAcademy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings5.1 Medium
- soosyzeSoosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic6.9 Medium
- webigniterWEBIGniter 28.7.23 Unrestricted File Upload Remote Code Execution8.7 High
- coppermine coppermine-gallery, coppermine-gallery coppermine photo gallery +1 moreCoppermine Gallery 1.6.25 Remote Code Execution via Plugin Upload8.7 High
- fntsoftware fnt commandFNT Command 13.4.0 is vulnerable to Directory Traversal.8.3 High
- fntsoftware fnt commandFNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module.8.8 High
- carmelo computer laboratory systemcode-projects Computer Laboratory System technical_staff_pic.php unrestricted upload5.1 Medium
- carmelo computer laboratory systemcode-projects Computer Laboratory System admin_pic.php unrestricted upload5.1 Medium
- wp3d model import viewerWP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- campcodes online student enrollment systemcampcodes Online Student Enrollment System register.php unrestricted upload6.9 Medium
- campcodes online student enrollment systemcampcodes Online Student Enrollment System index.php unrestricted upload5.1 Medium
- infility globalInfility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- wbce cmsWBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload8.6 High
- xbtitfmxbtitFM 4.1.18 Insecure File Upload in file_hosting Feature8.6 High
- bmc software compuware istrobe webCompuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload9.2 Critical
- elkarte forumElkArte Forum 1.1.9 Authenticated Remote Code Execution via Theme Upload8.6 High
- remyandrade real estate property listing appSourceCodester Real Estate Property Listing App property.php unrestricted upload5.1 Medium
- baowzh hflybaowzh hfly upload_json.php unrestricted upload5.3 Medium
- easyimages2.0 project easyimages2.0An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8...9.8 Critical
- easyimages2.0 project easyimages2.0An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8...8.8 High
- wbce cmsWBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload8.7 High
- s9y serendipitySerendipity 2.5.0 Remote Code Execution via Authenticated Media Upload8.6 High
- dotclearDotclear 2.29 Remote Code Execution via Authenticated File Upload8.7 High
- apprain, apprain cmf +1 moreappRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload8.6 High
- howfor qihang media web digital signageQiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution9.3 Critical
- videomerchant video merchantVideo Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- pipeshub, pipeshub-ai +1 morePipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload9.8 Critical
- adobe coldfusionColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)9.1 Critical
- lepton-cms leptoncmsLeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the...8.8 High
- campcodes retro basketball shoes online storeCampcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload5.1 Medium
- verysync, verysync 微力同步 +1 moreVerysync 微力同步 Web Administration text.txt unrestricted upload5.3 Medium
- carmelogarcia employee profile management systemcode-projects Employee Profile Management System add_file_query.php unrestricted upload5.3 Medium
- brainstormforce starter templates – ai-powered templates for elementor & gutenbergStarter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass8.8 High
- plugins360 all-in-one video galleryAll-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP8.8 High
- ajitdas flex qr code generatorFlex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- flexense diskbossFlexsense DiskBoss Application Crash Denial of Service8.7 High
- moderntribe auto thumbnailerAuto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- tsaiid featured image via urlFeatured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle Upload8.8 High
- contentstudioContentStudio <= 1.3.7 - Authenticated (Author+) Arbitrary File Upload8.8 High
- omnipressteam omnipressOmnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- kraft plugins demo importer plusDemo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass8.8 High
- zhaoyachao zdh webzdh_web is a data collection, processing, monitoring, scheduling, and management platform. In...8.8 High
- rtowebsites postgalleryPostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- e-point cmsThe E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An...4.3 Medium
- romm.app rommRomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover7.6 High
- Show moreLoading…