CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- wp-super-edit wp super editWordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload9.3 Critical
- krajowa izba rozliczeniowa szafirhostRemote Code Execution in SzafirHost8.6 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions8.7 High
- givanz vvvebVvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload8.6 High
- strapi, strapi @strapi/upload +1 moreStrapi Upload Plugin MIME Validation Bypass via Content API5.3 Medium
- shahinurislam career sectionCareer Section <= 1.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- cubecart v6CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API9.1 Critical
- No product listedAn arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang...7.3 High
- hahwul dalfoxDalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode8.2 High
- No product listedAn arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary...8.0 High
- No product listeddocuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate...6.3 Medium
- textpattern cmsTextPattern CMS 4.8.7 Remote Code Execution via File Upload8.7 High
- e107 cmse107 CMS 2.3.0 Authenticated Remote Code Execution via Theme Upload8.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Arbitrary File Upload and Path Traversal7.3 High
- emlogEmlog: Remote Code Execution via Malicious Plugin Upload0.0 None
- No product listedBitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE...6.3 Medium
- neorazorx facturascriptsFacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images6.3 Medium
- neorazorx facturascriptsRemote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism7.2 High
- revolution slider slider revolutionSlider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url8.8 High
- No product listedA Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in...6.5 Medium
- getgrav gravGrav: Low-privileged API users can create super-admin accounts via blueprint-upload8.7 High
- givanz vvvebVvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor5.1 Medium
- givanz vvvebVvveb < 1.0.8.2 RCE via Media Upload Handler8.7 High
- muffingroup bethemeBetheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload8.8 High
mckenziearts/livewire-markdown-editorPackagistlivewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler7.1 Highfunadmin/funadminPackagistfunadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload6.9 Medium- code-projects bloodbank managing systemcode-projects BloodBank Managing System request_blood.php unrestricted upload5.3 Medium
- devcode openstamanagerOpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality7.2 High
mindsdbPyPIMindsDB Engine proc_wrapper.py exec unrestricted upload6.9 Medium- acrel electrical eems enterprise power operation and maintenance cloud platformAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload5.3 Medium
- No product listedcrmeb_java Admin Upload UploadServiceImpl.java unrestricted upload5.1 Medium
- sunnet cpas, ctms, sun.net ehrd cpas +1 more +3 moreSunnet｜CTMS and CPAS - Arbitrary File Upload8.6 High
- wpeverest user registration advanced fieldsUser Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload9.8 Critical
- No product listedMacCMS Pro Plugin Installation add.html install unrestricted upload5.1 Medium
- weaver network co., ltd. e-officeWeaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet9.3 Critical
- ci4-cms-erp ci4msCI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution8.6 High
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload5.1 Medium
cockpit-hq/cockpitPackagistCockpit Vulnerable to Unrestricted Upload of File with Dangerous Type8.8 High- code-projects online music sitecode-projects Online Music Site AdminUpdateAlbum.php unrestricted upload5.1 Medium
- code-projects online lot reservation systemcode-projects Online Lot Reservation System edithousepic.php unrestricted upload5.1 Medium
- code-projects online lot reservation systemcode-projects Online Lot Reservation System activity.php unrestricted upload5.1 Medium
- code-projects invoice system in laravelcode-projects Invoice System in Laravel company unrestricted upload5.3 Medium
- No product listedGreenCMS index.php themeadd unrestricted upload5.3 Medium
- No product listedGreenCMS index.php pluginAddLocal unrestricted upload5.3 Medium
- addonsorg drag and drop file upload for contact form 7Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass8.1 High
- borg technology corporation spm 2007BorG Technology Corporation｜Borg SPM 2007 - Arbitrary File Upload9.3 Critical
- cloudways breeze cacheBreeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote9.8 Critical
- ibm security verify directory (container), security verify directory +1 moreSecurity vulnerability has been detected in IBM Security Verify Directory5.5 Medium
- aenrich a+hcmaEnrich｜a+HCM - Arbitrary File Upload5.1 Medium
- seeyon internet software a8+ collaborative management software, a8-v5 collaborative management software +1 moreSeeyon Office Anywhere (OA) A8 Unauthenticated Arbitrary File Write via htmlofficeservlet9.3 Critical
- Show moreLoading…