CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- shandong hoteam inforcenter plmShandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload6.9 Medium
- sourcecodester simple doctors appointment systemSourceCodester Simple Doctors Appointment System ajax.php unrestricted upload5.3 Medium
- basercmsbaserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)8.7 High
- rareprob video playerAn arbitrary file overwrite vulnerability in RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play...5.3 Medium
- promtengineer localgptPromtEngineer localGPT server.py do_POST unrestricted upload6.9 Medium
- bluditRemote Code Execution via Unrestricted File Upload in Bludit8.7 High
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability5.7 Medium
- itsourcecode free hotel reservation systemitsourcecode Free Hotel Reservation System index.php unrestricted upload5.1 Medium
- plank laravel-mediableUnsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable9.3 Critical
- kalcaddle kodboxkalcaddle kodbox Public Share userShare.class.php add privilege escalation6.3 Medium
- code16 sharpSharp has Unrestricted File Upload via Client-Controlled Validation Rules8.8 High
- golang tiff, golang.org/x/image golang.org/x/image/tiff +1 moreOOM from malicious IFD offset in golang.org/x/image/tiff5.3 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Type5.5 Medium
- halfdata green downloadsWordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerability9.9 Critical
- jordy meow photo engineWordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerability9.1 Critical
- denishua wpjam basicWordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability9.9 Critical
- deothemes onaWordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability9.9 Critical
- iqonicdesign wpbookit proWordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerability9.9 Critical
- phreesoft phreebooks erp, phreebookserp +1 morePhreeBooks ERP 5.2.3 Remote Code Execution via Image Manager8.7 High
- phreesoft phreebooks erp, phreebookserp +1 morePhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager8.7 High
- flexhexFlexHEX 2.71 Local Buffer Overflow via SEH Unicode8.6 High
- flexhex river past cam do, river past cam do project past cam do +1 moreRiver Past Cam Do 3.7.6 Local Buffer Overflow in Activation Code8.6 High
- artbees jupiter x coreJupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import8.8 High
- census cswebCensus CSWeb arbitrary file upload8.7 High
- opensource-workshop connect-cmsConnect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin8.2 High
- wwbn avideoAVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort8.8 High
- wwbn avideoAVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload8.8 High
- codephiliax chat2dbCodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted upload5.3 Medium
- unknown trx addonsThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload5.3 Medium
- ddz1977 anming mp3 cd burnerAnMing MP3 CD Burner 2.0 Local Denial of Service6.9 Medium
- acrel environmental monitoring cloud platformAcrel Environmental Monitoring Cloud Platform unrestricted upload6.9 Medium
- i-doit doit cmdb, i-doit +1 morei-doit CMDB 1.12 Arbitrary File Download via file_manager Parameter7.1 High
- owndmsownDMS 4.7 SQL Injection via pdfstream.php imagestream.php8.8 High
- eosphoros-ai db-gpteosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload5.3 Medium
- precurio intranet portalPrecurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload8.6 High
- error311 fileriseFileRise: WebDAV upload path bypasses filename validation enforced by regular uploads4.3 Medium
- apereo xerte online toolkits, xerte online toolkits +1 moreXerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution9.3 Critical
- aster-te terrapack tkservercgi, terrapack tkwebcoreng, terrapack tpkwebgis +2 moreThe Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions...8.8 High
- suitecrmSuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM2.7 Low
- themegoods photographyWordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability7.2 High
- syarif mobile app editorWordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability9.1 Critical
- rymera web co pty ltd. woocommerce wholesale lead captureWordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability9.0 Critical
- nhost, nhost storage +1 moreNhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload2.1 Low
- danvei233 xiaoheifsxiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)7.2 High
- danvei233 xiaoheifsxiaoheiFS Vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation)7.2 High
- aapanelAn arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary...9.8 Critical
- admidioAdmidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module8.8 High
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted upload6.9 Medium
- technologies integrated management platformTechnologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload6.9 Medium
- telesquare sdt-cs3b1, sdt-cs3b1 firmware +1 moreTelesquare SKT LTE Router SDT-CS3B1 WebDAV Arbitrary File Upload9.3 Critical
- Show moreLoading…