CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- bravis-themes bravis addonsWordPress Bravis Addons plugin <= 1.3.0 - Arbitrary File Upload vulnerability9.9 Critical
- zozothemes wiguardWordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- devolutions server, music-assistant music assistant server +1 moreMusic Assistant Server Path Traversal in Playlist Update API Allows Remote Code Execution8.8 High
- opensourcepos open source point of saleOpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php:...8.8 High
- wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 moreAuthenticated arbitrary file upload via a System REST API requiring administrator permission.9.1 Critical
- franchidesign slider futureSlider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload5.3 Medium
- tsinghua unigroup electronic archives systemTsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload6.9 Medium
- mingsoft mcmsmingSoft MCMS Template Archive uploadTemplate.do unrestricted upload5.1 Medium
- huanzi-qch base-adminhuanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload5.3 Medium
- fabian scholars tracking systemcode-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote...8.8 High
- ibm datastage on cloud pak, datastage on cloud pak for data +1 moreDataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment8.8 High
- ibm watsonx.dataPrivileged User File Upload Vulnerability Leading to Limited Server-Side Execution affects watsonx.data3.8 Low
- efm iptime a6004mxEFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload9.3 Critical
- adminkov midi-synthmidi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action9.8 Critical
- airleader gmbh masterAirleader Master Unrestricted Upload of File with Dangerous Type9.3 Critical
- ntn information processing services computer software hardware industry and trade ltd. co. smart panelInsecure File Upload in NTN Informatics' Smart Panel9.8 Critical
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- wpvividplugins wpvivid — backup, migration & stagingMigration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload9.8 Critical
- cipplanner cipaceUnrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and...8.8 High
- berabuddies agentflowFlowring｜Agentflow - Arbitrary File Upload8.7 High
- mylittleforum my little forum, my-little-forum mylittleforum +1 morePhar Deserialization leading to Arbitrary File Deletion in my little forum8.7 High
- birtech information technologies industry and trade ltd. co. sensawayUnrestricted File Upload in Birtech Information Technologies' Sensaway8.8 High
- douco douphpDouPHP ZIP File file.php unrestricted upload5.1 Medium
- code-projects online music sitecode-projects Online Music Site AdminAddAlbum.php unrestricted upload5.1 Medium
- great developers certificate generation system, greatdevelopers certificate +1 moreGreat Developers Certificate Generation System csv.php unrestricted upload5.3 Medium
- cradle e-commercedetronetdip E-commerce addadhar.php unrestricted upload6.9 Medium
- guchengwuyue yshopmallguchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload5.3 Medium
- code-projects online music sitecode-projects Online Music Site AdminUpdateCategory.php unrestricted upload6.9 Medium
- tpadmin project tpadminyuan1994 tpadmin WebUploader preview.php deserialization6.9 Medium
- jizhicmsjizhiCMS 1.6.7 - Arbitrary File Download8.6 High
- monstra cmsMonstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin....8.8 High
- n8nn8n Arbitrary File Write leading to RCE in n8n Merge Node9.4 Critical
- cisco meeting managementCisco Meeting Management Arbitrary File Upload Vulnerability8.8 High
- six apart ltd. movable type (cloud edition), movable type (software edition), movable type advanced (software edition) +3 more +5 moreA non-administrative user can upload malicious files. When an administrator or the product...5.1 Medium
- seezee wp foft loaderWP FOFT Loader <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload8.8 High
- hillstone networks operation and maintenance security gatewayArbitrary File Upload Vulnerability in Operation and Maintenance Security Gateway2.7 Low
- coto.world cotoAn arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing...6.5 Medium
- adlered bolo-solobolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload5.3 Medium
- arox school erp proSchool ERP Pro 1.0 Admin Profile Photo Upload Remote Code Execution Vulnerability8.6 High
- arox school erp proSchool ERP Pro 1.0 - Remote Code Execution8.7 High
- victor cms project cms, victoralagwu cmssite +1 moreVictor CMS 1.0 - Authenticated Arbitrary File Upload8.6 High
- gunet open eclass platform, openeclass +1 moreOpen eClass Has File Upload Filter Bypass via ZIP Archive Extraction4.3 Medium
- openeclass gunet openeclass, gunet open eclass platform +1 moreGUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass8.7 High
- skirridsystems os datahub mapsOS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Upload8.8 High
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file7.2 High
- stefanprodan podinfoPodinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS)6.1 Medium
- frangoteam fuxaFUXA contains an Unrestricted File Upload vulnerability9.8 Critical
- fpdfAn arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows...8.8 High
- mediacrushAn issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to...9.8 Critical
- Show moreLoading…