CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- glowxq glowxq-ojglowxq glowxq-oj SysFileController.java upload unrestricted upload6.9 Medium
- jawherkl node-api-postgresJawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload6.9 Medium
- linknacional pix for woocommercePix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- python, python software foundation cpython +1 moretarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling2.0 Low
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass8.8 High
- janobe resort reservation systemSourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted upload5.3 Medium
- tiandy video surveillance system 视频监控平台, video surveillance system firmware +1 moreTiandy Video Surveillance System 视频监控平台 CLS_REST_File.java uploadFile unrestricted upload5.3 Medium
- bytedeskBytedesk SVG File UploadRestService.java handleFileUpload unrestricted upload5.3 Medium
- bytedeskBytedesk SVG File UploadRestController.java uploadFile unrestricted upload5.3 Medium
- flowiseai flowiseFlowise: Arbitrary File Upload via MIME Spoofing8.2 High
- edtvEdTv 2 SQL Injection via id Parameter8.8 High
- precurio intranet portalPrecurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin5.3 Medium
- 2-plan plan team2-Plan Team 1.0.4 Arbitrary File Upload via managefile.php7.1 High
- natroteam natro macro, natromacro +1 moreNatro Macro: Malicious actions allowed through Discord RC Commands by any user6.4 Medium
- chartbrewChartbrew: Stored Cross-Site Scripting (XSS) via File Upload API6.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo: Authenticated Remote Code Execution via Unrestricted File Upload8.8 High
- microsoft devices pricing programMicrosoft Devices Pricing Program Remote Code Execution Vulnerability9.8 Critical
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload8.1 High
- templaza astroid framework, astroidframe.work astroid template framework +1 moreExtension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla10.0 Critical
- seppmailSEPPmail User Web Interface Arbitrary File Write to RCE10.0 Critical
- wp chill filrWordPress Filr plugin <= 1.2.14 - Arbitrary File Upload vulnerability8.5 High
- firassaidi woocommerce license managerWordPress WooCommerce License Manager plugin <= 7.0.6 - Arbitrary File Upload vulnerability9.1 Critical
- zozothemes charetyWordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerability9.9 Critical
- jordy meow ai engineWordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability9.1 Critical
- zozothemes nutrieWordPress Nutrie theme < 2.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- zozothemes keenarchWordPress Keenarch theme < 2.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- zozothemes lendizWordPress Lendiz theme < 2.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- backstage, linuxfoundation backstage plugin-techdocs-node, red hat developer hub 1.8 +2 more +4 more@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution7.7 High
- freescoutFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution10.0 Critical
- uncannyowl uncanny automator – easy automation, integration, webhooks & workflow builder pluginUncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload7.2 High
- nokia impactThe Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an...8.0 High
- wwbn avideoWWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction9.3 Critical
- studio fabryka dobrycms, studiofabryka dorbycms +1 moreRemote Code Execution via Unrestricted File Upload in DobryCMS9.3 Critical
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core has an Unrestricted Upload of File with Dangerous Type4.9 Medium
- intermesh group-office, groupoffice +1 moreGroup-Office Vulnerable to Remote Code Execution (RCE)9.4 Critical
- morelitea initiativeInitiative Vulnerable to Token Theft via Stored XSS in Document Uploads8.7 High
- wedevs user frontend: ai powered frontend posting, user directory, profile, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload8.8 High
- aces lorisLORIS media module vulnerable to remote code execution8.7 High
- feiyuchuixue sz-boot-parentfeiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload5.3 Medium
- freescoutFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache8.8 High
- killergerbah asbplayerAn arbitrary file upload vulnerability in the subtitle loading function of asbplayer v1.13.0...9.6 Critical
- dell wyse management suiteDell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File...7.2 High
- traccarTraccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload8.7 High
- shuoren smart heating integrated management platformShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted upload6.9 Medium
- fastapiadminFastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload5.3 Medium
- fastapiadminFastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload5.3 Medium
- fastapiadminFastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload5.3 Medium
- fastapiadminFastApiAdmin Download Endpoint controller.py download_controller information disclosure5.3 Medium
- getsimple-ce getsimple cms, getsimplecms-ce +1 moreGetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads7.1 High
- chamilo chamillo lmsChamilo LMS 1.11.8 Arbitrary File Upload via elfinder8.7 High
- Show moreLoading…