CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- onedesigns one user avatar | user profile pictureOne User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter7.5 High
- roskus prospero flow crmUnrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting4.8 Medium
- wp manage ninja fluent boards proWordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability9.1 Critical
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment8.8 High
- joomlaeventmanager.net jem - joomla event manager extension for joomlaJoomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.19.4 Critical
- wedevs erp: complete hr, accounting & crm suite built for woocommerceERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment9.8 Critical
- thinking software efenceThinking Software Technology｜Efence - Arbitrary File Upload8.7 High
- thinking software efenceThinking Software Technology｜EFence - Arbitrary File Upload9.3 Critical
- cayin technology cms-se, cms-ws, smp +2 moreCAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload8.6 High
- No product listedtamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and...4.6 Medium
- No product listedIn DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller...9.8 Critical
- No product listedAn arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North...9.8 Critical
- continew-org continew-adminContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints7.1 High
- pollen-robotics reachy miniReachy Mini: Unrestricted Upload of File with Dangerous Type5.3 Medium
- webkul qloappsWebkul QloApps improper file upload validation8.6 High
- trtek technological products computer software hardware industry and trade limited company software repository managementFile Upload in TRTEK Software's Software Repository Management9.8 Critical
- creativemindssolutions cm map locations – visualize and share your locations in a few clicksCM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action8.8 High
- vrana adminerAdminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload7.1 High
- tophive ultimateaiWordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability9.9 Critical
- roskus prospero flow crmUnrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG4.8 Medium
- itsourcecode online pharmacy systemitsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload6.9 Medium
- codeastro payroll systemitsourcecode Payroll System admin_class.php save_settings unrestricted upload6.9 Medium
- cybertutor newsiteserver (nss)CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload5.1 Medium
- 4xmen xshopxShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution9.1 Critical
- codeastro online job portalCodeAstro Online Job Portal update-profile.php unrestricted upload5.3 Medium
@nocobase/servernpmNocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code executionNo score- laravel-backpack crudbackpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk4.4 Medium
- laravel-backpack crudbackpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver6.6 Medium
- vsdesk) Missing Server-Side File Extension Validation in vsDesk9.4 Critical
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload5.1 Medium
- atutorRemote Code Execution via Unrestricted File Upload in ATutor8.7 High
- themagnifico52 warehouse cargoWordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability9.9 Critical
- themagnifico52 smart cleaningWordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability9.9 Critical
- indithemes it residenceWordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability9.9 Critical
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability9.1 Critical
- frauscher sensortechnik fds 102Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.8.6 High
- averta depicter — popup & slider builderDepicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import7.2 High
- No product listedDeDeCMS select_media_post.php unrestricted upload5.3 Medium
- wekanWekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback8.7 High
- elementor proWordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability9.0 Critical
- drupal screenshotScreenshot - Critical - Unsupported - SA-CONTRIB-2026-1027.3 High
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.310.0 Critical
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.6410.0 Critical
- joomla joomla\!, joomla! project cms, framework filesystem package +2 moreJoomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.28.9 High
- masteriyo - lms, themegrill masteriyo - lms +1 moreWordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability9.8 Critical
- edge22 studios ltd. gp premiumWordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability9.9 Critical
- wpwax templatiqWordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability9.9 Critical
- kamlesh parmar sync post with other siteWordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability9.9 Critical
- piotnet addons for elementor proWordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability9.6 Critical
- No product listedOpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload5.3 Medium
- Show moreLoading…