CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- nokia mantaray nmAn unrestricted file upload vulnerability in Nokia MantaRay NM7.8 High
- joomlack page builder, page builder ck, joomlack.fr page builder ck extension for joomla +2 moreJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.010.0 Critical
- krajowa izba rozliczeniowa szafirhostRemote Code Execution in SzafirHost8.6 High
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System controller.php add unrestricted upload6.9 Medium
- hanwang e-face general management platformHanwang e-Face General Management Platform upload.do unrestricted upload6.9 Medium
- h.view hv-500s6 ip cameraH.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous Type8.6 High
- daktronics dmp-5000, dmp-5000 firmware, dmp-8000 +3 more +5 moreDaktronics Controller Firmware Unrestricted Upload of File with Dangerous Type8.4 High
- templatespareWordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability9.1 Critical
- physcode travel bookingWordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability9.9 Critical
- themecatcher quformWordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability9.9 Critical
- pluggabl booster for woocommerceWordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability9.9 Critical
- daan.dev omgf proWordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability10.0 Critical
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.265.3 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.266.3 Medium
- tryghost ghostGhost: File Upload Content-Type Spoofing5.4 Medium
motioneyePyPImotionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)9.8 Critical- joomshaper sp page builder, joomshaper.net sp page builder extension for joomla +1 moreJoomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.210.0 Critical
- icagenda, icagenda.com icagenda extension for joomla +1 moreJoomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.1510.0 Critical
- parse-community parse-serverParse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist2.1 Low
- wdmtech vbizzJoomla! Component vBizz 1.0.7 Remote Code Execution8.7 High
- riganti dotvvmDotVVM: Unrestricted file upload5.3 Medium
- error311 fileriseFileRise shared-folder upload path traversal allows arbitrary file write and admin takeover9.3 Critical
- anton vanyukov offload, ai & optimize with cloudflare imagesOffload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action8.8 High
- hcl software zie, hcltech zie for web +1 moreHCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,4.3 Medium
- bdthemes sigmaforms pro – ai generated formsWordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability9.0 Critical
- themagnifico52 charity zoneWordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 kids gift shopWordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 ecommerce zoneWordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 restaurant zoneWordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability9.9 Critical
- a wp life webenvoWordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability9.9 Critical
- studio keren aga ltd. unlimited elements for elementor (premium)WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability9.9 Critical
- membership software wishlist member x, wishlist products, llc. member x +1 moreWordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerability9.9 Critical
- zozothemes restaurtWordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability9.9 Critical
- extendons wordpress & woocommerce scraper plugin, import data from any siteWordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerability10.0 Critical
- wplocker pt luxa addonsWordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Upload Vulnerability9.9 Critical
- candid themes gripWordPress Grip theme <= 1.0.9 - Arbitrary Plugin Activation/Deactivation to RCE vulnerability9.9 Critical
- academylms academy lms proWordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability8.0 High
- themagnifico52 kids online storeWordPress Kids Online Store theme <= 0.8.9 - Arbitrary File Upload vulnerability9.9 Critical
- premmerce dev toolsPremmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation8.8 High
- ahmad geekybotWordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability10.0 Critical
- cmsjunkie - wordpress business directory plugins wp-businessdirectoryWordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability9.9 Critical
- sc internet vivoo wpstreamWordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability5.4 Medium
- shipster baggage freight shipping australiaWordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload9.3 Critical
- tecrail responsive filemanagerRemote Code Execution via Unrestricted File Upload in Responsive FileManager9.3 Critical
- wertheim gmbh safecontroller software for vault rooms (safe deposit locker system)Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files5.3 Medium
- No product listedAn arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4...9.8 Critical
- parse-community parse-serverParse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist2.1 Low
- global it informatics services inc. weollArbitrary File Upload in Global IT's WEOLL8.7 High
- amasty order attributes for magento 2Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload9.3 Critical
- solidinvoiceSolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo8.1 High
- Show moreLoading…