CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- ci4-cms-erp ci4msCI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor10.0 Critical
- wildfirechat im-serverWildfire has Arbitrary File Upload via Directory Traversal in UploadFileAction9.8 Critical
- samsung magicinfo 9 serverAn unauthenticated user can upload arbitrary files to execute remote code, leading to privilege...8.8 High
- samsung magicinfo 9 serverA vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without...9.8 Critical
- efm iptime a8004t, iptime a8004t firmware +1 moreEFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted upload5.1 Medium
- koken cmsKoken CMS 0.22.24 - Arbitrary File Upload8.7 High
- internet information co., ltd dreammakerInterinfo DreamMaker - Unrestricted Upload of File with Dangerous Type10.0 Critical
- meddream pacs serverMedDream PACS Server 6.8.3.751 - Remote Code Execution8.7 High
- erugoAuthenticated Remote Code Execution via Arbitrary File Upload10.0 Critical
- nocodbNocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload8.5 High
- explorance blueUnauthenticated Remote File Download in Explorance Blue9.9 Critical
- guidoneele pdw file browserPDW File Browser 1.3 - Remote Code Execution8.7 High
- explorance blueUnrestricted File Upload Vulnerability in Explorance Blue9.1 Critical
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint7.2 High
- victor cms project cms, victoralagwu cmssite +1 moreVictor CMS 1.0 - File Upload To RCE8.7 High
- datavane tisA XStream Security Vulnerability in XML Deserialization in datavane/tis10.0 Critical
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php.9.8 Critical
- carmelo computer book storecode-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php.9.8 Critical
- ijason-liu books manageriJason-Liu Books_Manager upload_bookCover.php unrestricted upload5.1 Medium
- phpgurukul news portalPHPGurukul News Portal Profile Pic unrestricted upload5.1 Medium
- code-projects online examination systemcode-projects Online Examination System admin_pic.php unrestricted upload5.3 Medium
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import7.5 High
- irisideatechsolutions kalrav ai agentKalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action9.8 Critical
- phreesoft phreebooksPhreeBooks 5.2.3 - Remote Code Execution8.7 High
- mfscripts yetishare file hosting scriptYetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability6.9 Medium
- the textpattern development team textpatternTextpattern 4.8.3 - Remote code execution8.7 High
- remyandrade modern image gallery appA Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file con…9.8 Critical
- xpro elementor addonsWordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerability9.1 Critical
- zozothemes miionWordPress Miion theme <= 1.2.7 - Arbitrary File Upload vulnerability9.9 Critical
- blazethemes blogzeeWordPress Blogzee theme <= 1.0.5 - Arbitrary File Upload vulnerability9.9 Critical
- blazethemes blogisticWordPress Blogistic theme <= 1.0.5 - Arbitrary File Upload vulnerability9.9 Critical
- garidium g-ffl checkoutWordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability10.0 Critical
- inspirythemes real homes crmWordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerability9.9 Critical
- blazethemes news eventWordPress News Event theme <= 1.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- blazethemes blogmaticWordPress Blogmatic theme <= 1.0.3 - Arbitrary File Upload vulnerability9.9 Critical
- farost energiaWordPress Energia theme <= 1.1.2 - Arbitrary File Upload vulnerability10.0 Critical
- solvera software services trade inc. teknoeraArbitrary File Upload in Solvera Software's Teknoera8.1 High
- amastar technology meetinghub, hamastar meetinghub paperless meetings +1 moreAMASTAR Technology｜MeetingHub - Arbitrary File Upload9.3 Critical
- horillaHorilla has File Upload XSS5.4 Medium
- horillaHorilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover8.8 High
- No product listedFile Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818...10.0 Critical
- saleorSaleor vulnerable to stored XSS via Unrestricted File Upload8.5 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software8.8 High
- browan communications prismx mx100 ap controllerBROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Arbitrary File Upload8.6 High
- hcl aionHCL AION is affected by an Unrestricted File Upload vulnerability3.1 Low
- technical-laohu mpaytechnical-laohu mpay QR Code Image unrestricted upload5.1 Medium
- lwj flowlwj flow SVG File FormResource.java uploadFile unrestricted upload5.3 Medium
- eyoucmsEyouCMS Member Avatar Diyajax.php check_userinfo unrestricted upload5.3 Medium
- xiweicheng tms, teamwork management system +1 morexiweicheng TMS FileController.java upload unrestricted upload5.3 Medium
- wpchill filr – secure document libraryFilr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload4.4 Medium
- Show moreLoading…