CWE-434: Unrestricted File Upload
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Also known as Unrestricted Upload of File with Dangerous Type.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- gz-yami mall4jmall4j through 4.0 Unrestricted File Upload in Admin File Endpoints2.1 Low
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module8.7 High
- acrel electric unet web serviceAcrel Electric Unet Web Service Upload Endpoint upload unrestricted upload5.3 Medium
- manageengine ddi centralAuthenticated Arbitrary File Write8.8 High
- manageengine ddi centralAuthenticated File Write to RCE via keepalived in DDI Central8.8 High
- bimser solution software trade inc. eba plus document and workflow management systemArbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus8.8 High
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field9.8 Critical
- acymailing, acymailing.com acymailing enterprise extension for joomla +1 moreJoomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.09.5 Critical
- addify request a quote for woocommerceRequest a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler9.8 Critical
- gestsupGestSup before 3.2.62 Remote Code Execution via IMAP Attachment9.2 Critical
- piwigoPiwigo: Authenticated RCE via File Upload in Logo Upload Feature9.1 Critical
- honeywell pd45 industrial printerAuthenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface8.8 High
- honeywell pd45 industrial printerUnauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.0100409.8 Critical
- netlink ict pvt ltd ict hg323rw routerCommand Injection Vulnerability in Netlink ICT HG323RW Router8.6 High
- plank laravel-mediableLaravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload9.3 Critical
- neethuharii cafemanagementNeethuharii CafeManagement AddProductCode.php unrestricted upload6.9 Medium
- doccms administration panelMultiple vulnerabilities in the Microweber administration panel8.4 High
- therealsain pixtreamtheRealSain Pixtream post_upload.php unrestricted upload5.3 Medium
- anirbandutta9 college-notes-galleryanirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload5.3 Medium
- josephchuks php-file-manager-with-code-editorJosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload6.9 Medium
- josephchuks php-file-manager-with-code-editorJosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload6.9 Medium
- No product listedAn unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index...8.8 High
- tautulliTautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database7.0 High
- mispMISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension8.6 High
- unknown web to print online designerWooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- No product listedEMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.6.1 Medium
- No product listedJazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the...8.8 High
- No product listedUnrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2...7.2 High
- ordasoft.com ordasoft joomla gallery extension for joomla, ordasoft joomla gallery free extension for joomla +1 moreJoomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.79.4 Critical
- nivocartNivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager8.7 High
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import7.2 High
- themefic ultra addons for contact form 7Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field6.5 Medium
- gravity forms formsGravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field9.8 Critical
- deleeuw share-one-drive | onedrive & sharepoint plugin for wordpress, wp cloud plugins - box (lets-box), wp cloud plugins - dropbox (out-of-the-box) +1 more +3 moreWP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import8.8 High
- macwarrior clipbucket-v5ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint8.7 High
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.6.4 Medium
- chamilo chamilo-lmsChamilo LMS CStudio upload flow allows unauthenticated remote code execution9.8 Critical
- danielbrendel hortusfox-webHortusFox-Web < 6.1 Remote Code Execution via Import/Export8.6 High
- sh1zen multi uploader for gravity formsMulti Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload9.8 Critical
- ichurakov paid downloadsPaid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action8.1 High
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import8.8 High
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter8.8 High
- synaptikcms synaptik-cmssynaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload5.1 Medium
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of...8.6 High
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of...8.6 High
- dell wyse management suiteDell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of...8.6 High
- No product listedWuzhiCMS Avatar Upload index.php setAvatar unrestricted upload5.3 Medium
- sourcecodester online faculty clearance systemSourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload5.3 Medium
- sourcecodester college notes gallery management systemSourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload5.3 Medium
- contec co., ltd. can-2-usb, can-2-wf +1 moreUnrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication...8.6 High
- Show moreLoading…