CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration9.8 Critical
- wordpressWordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A m…8.8 High
- progress sharefile storage zones controllerPath traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller7.2 High
- 2100 technology official document management system2100 Technology｜Official Document Management System - Arbitrary File Upload8.7 High
- No product listedFile Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute...9.8 Critical
- No product listedFile Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows...8.8 High
- prosolution wp clientProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override9.8 Critical
- daggerhart query wranglerQuery Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter8.8 High
- pandora-analysis pandoraUnbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb8.7 High
- wpdevteam templately – elementor & gutenberg template library: 6500+ free & pro ready templates and cloud!Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch8.8 High
- sadathimel maxupload – big file uploads – increase maximum file upload sizeMaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter8.8 High
- sourcecodester simple doctors appointment systemSourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload5.1 Medium
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of...7.2 High
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of...7.2 High
- smewebify weberpmesv2WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)9.8 Critical
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.6.8 Medium
- unknown woocommerce subscriptionsWooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection9.8 Critical
- unknown giftwareGift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload9.8 Critical
- cisagov malcolmMalcolm vulnerable to RCE via unrestricted .php upload to the file-upload component8.7 High
- instawp connect – 1-click wp staging & migrationInstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure7.5 High
- cockpit cmsCockpit CMS Cockpit CMS - Unrestricted File Upload8.8 High
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8 +3 more +5 moreWildfly-core: wildfly: arbitrary file read via malicious archive deployment6.5 Medium
- dulldusk phpfmdulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload9.8 Critical
- tychesoftwares product input fields for woocommerceProduct Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- bogdan bendziukov squeezeSqueeze < 1.7.12 - Author+ Arbitrary File Upload8.8 High
- saigroup saiadminsaithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload5.1 Medium
- sourcecodester photo share websiteSourceCodester Photo Share Website ajax.php save_upload unrestricted upload5.3 Medium
- weaver network co., ltd. e-cology 9.0Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp9.3 Critical
- statamic cmsStatamic: Missing file upload validation on frontend forms allows uploading disallowed file types5.3 Medium
- datalinkdc dinkyDinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token9.3 Critical
- sourcecodester online examination & learning management systemSourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload5.3 Medium
- wso2 api control plane, api manager, api manager publisher rest api v4 +4 more +6 moreArbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution9.1 Critical
- brandexponents type hubWordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability10.0 Critical
- No product listedICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in...9.8 Critical
- rongzhitong visual integrated command and dispatch platformRongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload6.9 Medium
- cyber-iii student-management-systemimranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload5.3 Medium
- gamerz wp-downloadmanagerwp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal7.2 High
- pluck cms cms, pluck-cms pluck cms +1 morePluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist7.2 High
- lightsyncpro lightsync pro – connect & sync cloud assets | lightroom, canva, figma, dropbox & shutterstockLightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload8.8 High
- unknown zportalsZportals < 6.3.4 - Subscriber+ Arbitrary File Upload8.1 High
- cvat-ai cvatCVAT has stored XSS via annotation guide assets8.5 High
- trippo responsivefilemanagerTrippo ResponsiveFilemanager dialog.php unrestricted upload6.9 Medium
- bilin software and informatics consultancy inc. humanist digital human resourcesUnrestricted File Upload in Bilin Software's HUMANIST Digital Human Resources9.8 Critical
- refirio freo2freo2 provided by refirio contains an unrestricted upload of file with dangerous type...8.6 High
- unknown chat widget: floating customer support button for 30+ channels, supporting sms, calls, and chatBit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint6.5 Medium
- unknown improve seoImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution9.8 Critical
- websitebaker org e.v. cmsWebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation8.6 High
- open-emr openemrOpenEMR Authenticated SQL Injection via backup.php Import Feature8.6 High
- unknown personal qr messagePersonal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- brian batt - elearningfreak.com insert or embed articulate content into wordpressInsert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload9.8 Critical
- Show moreLoading…