CWE-616: Incomplete Identification of Uploaded File Variables (PHP)
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type).
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- makeplane plane Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) 8.7 High
- perspective-dev perspective Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher 8.7 High
- invoiceplane File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload... 9.9 Critical
- smewebify weberpmesv2, wem-project wem +1 more WebErpMesv2 has a File Upload Validation Bypass Leading to RCE 5.4 Medium
- flocksafety bravo compute box firmware Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default... 5.4 Medium
- No product listed File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php... 5.4 Medium
- unopim UnoPim Stored XSS : Cookie hijacking through Create User function 6.5 Medium
- panabit panalog An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v.... 9.8 Critical
- byzoro smart s210 firmware File Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent... 6.5 Medium
- misp In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not... 9.8 Critical
- wbce cms An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1... 7.2 High