CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- contec co., ltd cps-tm341g5mb-adsc1-931, cps-tm341gmb-adsc1-931, cps-tm341mb-adsc1-931 +2 moreUnrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a...8.7 High
- digitaldruid hoteldruidHotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function.6.6 Medium
- anil-matcha open-generative-aiAnil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload6.9 Medium
- phpgurukul bank locker management systemPHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload5.3 Medium
- lenve vhrlenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload5.3 Medium
- unknown wp images upload on piclectWP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- unknown ds ad rotatorDS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload9.8 Critical
- unknown gpx2graphicsGpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF7.2 High
- mulika mipl grouped checkout fields for woocommerce. customize & organize checkout fields.MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- xootix otp login & register woocommerceOTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force5.3 Medium
- d-zero co.,ltd. burgereditorBurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with...8.5 High
- add-ons.org drag and drop file upload for elementor formsDrag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter9.8 Critical
- maxsite cmsMaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page5.1 Medium
- rara themes one click demo importRara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE8.6 High
- No product listedAn arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0....9.8 Critical
- instantsoft icms2InstantCMS has Remote Code Execution in package installer5.5 Medium
- aircheng-org iwebshop-5aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload6.9 Medium
- siemens siveillance control pro v3.0, siveillance control pro v4.0, siveillance control v3.0 +1 more +3 moreA vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173)...8.9 High
- light0011 cmslight0011 cms Upload.class.php upload unrestricted upload6.9 Medium
- beijing meite software technology u+smart enjoyment websiteBeijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload6.9 Medium
- liufee feehicmsliufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload6.9 Medium
- voltronic power snmp web proVoltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi9.3 Critical
- stellarwp learndash lmsLearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler7.5 High
- No product listedAn arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute...8.1 High
- No product listedAn arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway...8.8 High
- No product listedFile Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute...8.1 High
- No product listedeasyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the...9.8 Critical
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload6.9 Medium
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload5.3 Medium
- No product listedILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload5.3 Medium
- ocs inventory ng ocsreportsMultiple vulnerabilities in Ocsreports for OCS Inventory NG9.4 Critical
- unopimUnoPim File Upload RCE via TinyMCE Image Upload Endpoint8.6 High
- unknown developer toolsDeveloper Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload9.8 Critical
- unknown embed html5 gameEmbed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload10.0 Critical
- progress software telerik ui for asp.net ajaxDialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- mozilla thunderbirdCalendar invitation attachments could launch local executables9.8 Critical
- gravity forms formsGravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion8.1 High
- manacle technologies multi-tenant erp systemRemote Code Execution Vulnerability in Manacle Technologies ERP System10.0 Critical
- wplegalpages wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeWPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint9.8 Critical
- shopex ecshopShopEx ECShop pack.php check_img_type unrestricted upload6.9 Medium
- studio-42 elfinderelFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)8.1 High
- hashthemes hash formWordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability10.0 Critical
- wp legal pages cookie notice for gdpr, ccpa & eprivacy consentWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability10.0 Critical
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.108.9 High
- diem-project diemdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload5.3 Medium
- jeecgboot jeewx-bootjeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload5.1 Medium
- cozmoslabs profile builder pluginCozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload6.9 Medium
- bookstackapp bookstackBookStack before 26.05.4 Remote Code Execution via Book Cover8.7 High
- bdthemes sigmaforms pro – ai generated formsSigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field9.8 Critical
- cloudways breeze cacheBreeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal5.3 Medium
- Show moreLoading…