CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- sanjay1313 visitor management systemVisitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php...7.2 High
- vvveb cmsVvveb CMS 1.0.8.2 Remote Code Execution via Media Upload8.7 High
- vvveb cmsVvveb CMS < v1.0.8.2 Remote Code Execution via Media Management9.2 Critical
- openmage magento, magento-lts +1 moreOpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution8.7 High
- pip maintainers pippip doesn't reject concatenated ZIP and tar archives4.6 Medium
- No product listedZ-BlogPHP ZBA File app_upload.php UnPack unrestricted upload5.1 Medium
- rickxy hospital management systemrickxy Hospital Management System his_admin_account.php unrestricted upload6.9 Medium
- langflow-ai langflowlangflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload6.9 Medium
- No product listedEyouCMS Index.php edit_adminlogo unrestricted upload5.1 Medium
- niteo cmp – coming soon & maintenance plugin by niteothemesCMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution8.8 High
- gitroom postiz, gitroomhq postiz-app +1 morePostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS8.9 High
- churchcrm crmChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function9.1 Critical
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass8.1 High
- querymine smsQueryMine sms Background Management addteacher.php unrestricted upload5.3 Medium
- flowiseai flowiseFlowise: File Upload Validation Bypass in createAttachment7.1 High
- weblateWeblate: Remote code execution during backup restoration8.1 High
- owen webstackWebStack <= 1.2024 - Unauthenticated Arbitrary File Upload9.8 Critical
- No product listedAn authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of...9.9 Critical
- enchant97 note-markNote Mark has Stored XSS via Unrestricted Asset Upload8.7 High
- pachnoPachno 1.0.6 Unrestricted File Upload Remote Code Execution8.7 High
- artica pandora fms, pandora fms fms +1 moreUnrestricted File Upload in Extension Uploader leads to Remote Code Execution8.6 High
- r-project rguiRGui 3.5.0 Local Buffer Overflow SEH DEP Bypass8.6 High
- lin-snow ech0Ech0 before 4.4.3 Stored XSS via SVG Upload4.8 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint7.1 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE7.5 High
- prosolution wp clientProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess9.8 Critical
- tidevapps gerador de certificados – devappsGerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- mlfactory dsgvo google web fonts gdprDSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter9.8 Critical
- icz matcha invoiceUnrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier....5.1 Medium
- openclawOpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass2.3 Low
- churchcrm, churchcrm crm +1 moreChurchCRM has a Path traversal leads to RCE9.1 Critical
- saturdaydrive ninja forms - file uploadsNinja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload9.8 Critical
- chyrplite chyrp lite, xenocrat chyrp-lite +1 moreChyrp Lite has a Path Traversal to Remote Code Execution9.1 Critical
- ajax30 bravecms, bravecms-2.0 +1 moreBrave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint8.8 High
- ajax30 bravecms, bravecms-2.0 +1 moreBrave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint9.3 Critical
- cyber-iii student-management-systemCyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload5.3 Medium
- gnu tar, red hat discovery 2, enterprise linux 10 +7 more +9 moreTar: tar: hidden file injection via crafted archives5.0 Medium
- unisharp laravel file managerUniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload8.7 High
- jkev record management systemSourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload5.1 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 fs unrestricted upload6.9 Medium
- campcodes complete online learning management systemCampcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted upload5.3 Medium
- snewscms snews, snews cms upload sheller +1 moreSnews CMS 1.7 Unrestricted File Upload via snews_files9.3 Critical
- purethemes listeo-core - directory plugin by purethemesListeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload5.3 Medium
- projectsandprograms school management systemProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload5.3 Medium
- openclawOpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal7.6 High
- kovai biztalk360An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user...8.8 High
- hytalemodding wikiHytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`8.7 High
- progress sharefile storage zones controllerRCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)9.1 Critical
c2cciutilsPyPIc2cciutils affected by CVE-2022-408966.8 Medium- harvard university iqss dataverseHarvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload5.3 Medium
- Show moreLoading…