CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- omnilogic omni secure filesOmni Secure Files < 0.1.14 Unauthenticated Arbitrary File Upload9.3 Critical
- stackideas easydiscuss, stackideas.com easydiscuss extension for joomla +1 moreExtension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla4.8 Medium
- bee interactive livewire filemanager, livewire-filemanager filemanager +1 moreCVE-2025-148949.8 Critical
- plugins360 all-in-one video galleryAll-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass8.8 High
- websitebakerWebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)8.7 High
- phpwcmsPhpwcms 1.9.30 - Arbitrary File Upload5.3 Medium
- steven uploadifyUploadify <= 1.0 Unauthenticated Arbitrary File Upload9.3 Critical
- projeqtor project managementProjeQtOr Project Management 9.1.4 - Remote Code Execution9.3 Critical
- chikitsa patient management system, dharashah chikitsa patient management system +1 moreChikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated)8.7 High
- chikitsa patient management system, dharashah chikitsa patient management system +1 moreChikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated)8.7 High
- phpkf cmsphpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)9.3 Critical
- divisupreme supreme modules lite – divi theme, extra theme and divi builderSupreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass8.8 High
- agora-projectFile upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute...9.8 Critical
- agora-projectFile upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or...8.8 High
- viaviweb wallpaper adminVIAVIWEB Wallpaper Admin 1.0 - Code Execution via Image Upload9.3 Critical
- e107, e107 cms +1 moree107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override8.6 High
- wbce cmsWBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)8.7 High
- e107, e107 cms +1 moree107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override8.7 High
- impresscmsImpressCMS 1.4.4 - Unrestricted File Upload9.3 Critical
- e107, e107 cms +1 moree107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE8.6 High
- kalyan02 nanocmsNanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated)8.6 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 moreAuthenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management Interface7.2 High
- pegasystems pega infinityPega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.5.3 Medium
- sap se fiori app (intercompany balance reconciliation)Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)6.6 Medium
- hubert hubAn arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e...9.8 Critical
- emlogemlog Arbitrary File Upload Vulnerability9.3 Critical
- smewebify weberpmesv2, wem-project wem +1 moreWebErpMesv2 has a File Upload Validation Bypass Leading to RCE5.4 Medium
- flipped-aurora gin-vue-adminGin-vue-admin has arbitrary file upload vulnerability caused by path traversal7.3 High
- dfir-iris iris, iris-web +1 moreIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management9.6 Critical
- covid-19 contact tracing system project contact tracing systemSourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution)....9.8 Critical
- automai directorAn issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the...8.8 High
- sangfor operation and maintenance management system, operation and maintenance security management system +1 moreSangfor Operation and Maintenance Management System common.jsp unrestricted upload6.9 Medium
- biggidroid simple php cmsBiggiDroid Simple PHP CMS editsite.php unrestricted upload5.1 Medium
- gunet openeclassOpen eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)7.3 High
- zozothemes corpkitWordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerability9.9 Critical
- contentstudioWordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability9.1 Critical
- loopus wp cost estimation & payment forms builderWP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete9.8 Critical
- webkul qloappsUnrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows...9.8 Critical
- eastsidecode wp enable webpWP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Upload8.8 High
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload6.1 Medium
- softwareag arisA file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code...6.8 Medium
- projectworlds house rental and property listing, house rental and property listing project +1 moreprojectworlds House Rental and Property Listing Signup register.php unrestricted upload6.9 Medium
- themefy bloggie, themify photobox, rezo +6 more +8 moreArbitrary File Upload Vulnerability in WordPress themes by Themify9.9 Critical
- n8nn8n is vulnerable to Remote Code Execution via Arbitrary File Write10.0 Critical
- meow apps media file renamerWordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerability9.1 Critical
- themify shopoWordPress Shopo <= 1.1.4 - Arbitrary File Upload Vulnerability9.9 Critical
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 moreQuanta Computer｜QOCA aim AI Medical Cloud Platform - Arbitrary File Upload8.7 High
- cld378632668 javamallcld378632668 JavaMall MinioController.java upload unrestricted upload5.3 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System prod.php unrestricted upload5.3 Medium
- code-projects content management systemcode-projects Content Management System edit_posts.php unrestricted upload5.1 Medium
- Show moreLoading…