CWE-434 · Unrestricted Upload of File with Dangerous Type (page 10)
Page 10 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9113 | Critical | 9.8 | 2025-09-08 | The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' functio… |
CVE-2025-9112 | High | 8.8 | 2025-09-08 | The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccure_temp_file_uploader' function in a… |
CVE-2025-56265 | High | 8.8 | 2025-09-08 | An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uplo… |
CVE-2025-10085 | Medium | 6.3 | 2025-09-08 | A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file manage_website… |
CVE-2025-10083 | Medium | 6.3 | 2025-09-08 | A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2025-10081 | Medium | 4.7 | 2025-09-08 | A flaw has been found in SourceCodester Pet Management System 1.0. This impacts an unknown function of the file /admin/profile.php. This manipulation of the ar… |
CVE-2025-9515 | High | 7.2 | 2025-09-06 | The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versio… |
CVE-2025-58819 | Critical | 9.1 | 2025-09-05 | Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.Th… |
CVE-2025-9942 | Medium | 6.3 | 2025-09-04 | A vulnerability has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /submitproperty.php. The manipulatio… |
CVE-2025-9941 | Medium | 6.3 | 2025-09-04 | A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing manipulation of the… |
CVE-2025-6085 | High | 7.2 | 2025-09-04 | The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all… |
CVE-2025-20287 | Medium | 4.3 | 2025-09-03 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upl… |
CVE-2025-57148 | Critical | 9.1 | 2025-09-03 | phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation. |
CVE-2025-9847 | Medium | 6.3 | 2025-09-03 | A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php. This manipulation… |
CVE-2025-9841 | Medium | 6.3 | 2025-09-03 | A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php… |
CVE-2025-52546 | Medium | 6.1 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By upl… |
CVE-2025-9800 | Medium | 6.3 | 2025-09-01 | A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file app… |
CVE-2025-9795 | Medium | 6.3 | 2025-09-01 | A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/con… |
CVE-2025-9775 | High | 7.3 | 2025-09-01 | A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulation of the argument i… |
CVE-2025-9772 | High | 7.3 | 2025-09-01 | A vulnerability was detected in RemoteClinic up to 2.0. This affects an unknown part of the file /staff/edit.php. Performing manipulation of the argument image… |
CVE-2025-31100 | Critical | 9.9 | 2025-08-31 | Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to a Web Server.This issue affects School… |
CVE-2012-10062 | | 2025-08-30 | A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute… | |
CVE-2009-20011 | | 2025-08-30 | ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of… | |
CVE-2025-54944 | Critical | 9.8 | 2025-08-30 | An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write m… |
CVE-2025-58159 | Critical | 9.9 | 2025-08-29 | WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validatio… |
CVE-2024-13342 | High | 8.1 | 2025-08-29 | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' functi… |
CVE-2025-58048 | Critical | 9.9 | 2025-08-28 | Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a maliciou… |
CVE-2025-31979 | Medium | 5.4 | 2025-08-28 | A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions… |
CVE-2024-13986 | High | 8.8 | 2025-08-28 | Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config S… |
CVE-2025-49387 | Critical | 10.0 | 2025-08-28 | Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elemen… |
CVE-2025-54762 | Critical | 9.8 | 2025-08-28 | SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands wi… |
CVE-2025-53970 | Critical | 9.8 | 2025-08-28 | SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands wi… |
CVE-2024-9648 | Medium | 6.1 | 2025-08-28 | The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class… |
CVE-2025-34163 | | 2025-08-27 | Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access… | |
CVE-2024-13981 | | 2025-08-27 | LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its… | |
CVE-2023-7309 | | 2025-08-27 | A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management… | |
CVE-2025-52353 | Critical | 9.8 | 2025-08-26 | An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via t… |
CVE-2025-9476 | High | 7.3 | 2025-08-26 | A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality of the file /Super… |
CVE-2025-9475 | High | 7.3 | 2025-08-26 | A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin_Da… |
CVE-2025-9415 | Medium | 6.3 | 2025-08-25 | A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation… |
CVE-2025-53119 | High | 7.5 | 2025-08-25 | An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server. |
CVE-2025-9406 | Medium | 6.3 | 2025-08-25 | A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component c… |
CVE-2025-9400 | Medium | 6.3 | 2025-08-25 | A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation… |
CVE-2025-9397 | Medium | 6.3 | 2025-08-24 | A weakness has been identified in givanz Vvveb up to 1.0.7.2. Affected is an unknown function of the file /system/traits/media.php. Executing manipulation of t… |
CVE-2025-36174 | High | 8.0 | 2025-08-24 | IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by anot… |
CVE-2025-43766 | Critical | 9.8 | 2025-08-23 | The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12… |
CVE-2025-55455 | Low | 3.5 | 2025-08-22 | DooTask v1.0.51 was dicovered to contain an authenticated arbitrary download vulnerability via the component /msg/sendtext. |
CVE-2025-26498 | High | 7.3 | 2025-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Abso… |
CVE-2025-26497 | High | 7.3 | 2025-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Travers… |
CVE-2025-55454 | High | 8.8 | 2025-08-22 | An authenticated arbitrary file upload vulnerability in the component /msg/sendfiles of DooTask v1.0.51 allows attackers to execute arbitrary code via uploadin… |
CVE-2025-54460 | High | 7.1 | 2025-08-21 | The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) t… |
CVE-2025-27714 | Medium | 6.3 | 2025-08-21 | An attacker could exploit this vulnerability by uploading arbitrary files via the a specific endpoint, leading to unauthorized remote code execution or syste… |
CVE-2025-24489 | Medium | 6.3 | 2025-08-21 | An attacker could exploit this vulnerability by uploading arbitrary files via a specific service, which could lead to system compromise. |
CVE-2025-55743 | High | 8.8 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation featur… |
CVE-2025-55383 | High | 8.6 | 2025-08-21 | Moss before v0.15 has a file upload vulnerability. The "upload" function configuration allows attackers to upload files of any extension to any location on the… |
CVE-2025-53251 | Critical | 9.9 | 2025-08-21 | Unrestricted Upload of File with Dangerous Type vulnerability in An-Themes Pin WP pin-wp allows Upload a Web Shell to a Web Server.This issue affects Pin WP: f… |
CVE-2025-9296 | Medium | 4.7 | 2025-08-21 | A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Suc… |
CVE-2025-49222 | Medium | 6.8 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, 10.10.x <= 10.10.0 fail to validate upload types in remote cluster… |
CVE-2025-55746 | Critical | 9.3 | 2025-08-20 | Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechan… |
CVE-2025-43750 | Medium | 6.5 | 2025-08-20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-54677 | Critical | 9.1 | 2025-08-20 | Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita a… |
CVE-2025-53213 | Critical | 9.9 | 2025-08-20 | Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping elex-reachship-multi-c… |
CVE-2025-48148 | Critical | 10.0 | 2025-08-20 | Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Using Maliciou… |
CVE-2025-9153 | Medium | 6.3 | 2025-08-19 | A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operation… |
CVE-2025-8450 | High | 8.2 | 2025-08-19 | Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms pag… |
CVE-2025-51489 | Medium | 5.4 | 2025-08-19 | A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/… |
CVE-2025-50897 | Medium | 4.3 | 2025-08-19 | A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with wr… |
CVE-2025-9099 | Medium | 6.3 | 2025-08-18 | A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNews… |
CVE-2025-7441 | Critical | 9.8 | 2025-08-16 | The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the… |
CVE-2025-6079 | High | 8.8 | 2025-08-16 | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php… |
CVE-2025-54473 | | 2025-08-15 | An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the… | |
CVE-2025-6679 | Critical | 9.8 | 2025-08-15 | The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.2… |
CVE-2025-8965 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/… |
CVE-2025-54693 | Critical | 9.0 | 2025-08-14 | Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects For… |
CVE-2025-24775 | Critical | 9.9 | 2025-08-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2012-10056 | | 2025-08-13 | PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload fil… | |
CVE-2012-10054 | Critical | 9.8 | 2025-08-13 | Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRS… |
CVE-2025-8297 | High | 7.2 | 2025-08-12 | Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve r… |
CVE-2025-33023 | Medium | 4.1 | 2025-08-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDC… |
CVE-2025-8859 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slide… |
CVE-2012-10038 | | 2025-08-11 | Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file type… | |
CVE-2025-8841 | Medium | 6.3 | 2025-08-11 | A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/fi… |
CVE-2025-8798 | High | 7.3 | 2025-08-10 | A vulnerability was found in oitcode samarium up to 0.9.6. It has been classified as critical. Affected is an unknown function of the file /dashboard/product o… |
CVE-2025-8775 | Medium | 6.3 | 2025-08-09 | A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of t… |
CVE-2025-8764 | Medium | 6.3 | 2025-08-09 | A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The m… |
CVE-2012-10052 | | 2025-08-08 | EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types… | |
CVE-2012-10050 | | 2025-08-08 | CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails t… | |
CVE-2012-10049 | | 2025-08-08 | WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitiz… | |
CVE-2012-10045 | | 2025-08-08 | XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw res… | |
CVE-2012-10044 | | 2025-08-08 | MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or autho… | |
CVE-2012-10042 | | 2025-08-08 | Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (… | |
CVE-2012-10036 | | 2025-08-08 | Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate t… | |
CVE-2025-55135 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG… |
CVE-2025-51056 | High | 8.2 | 2025-08-06 | An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploit… |
CVE-2025-50286 | High | 8.1 | 2025-08-06 | A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install… |
CVE-2025-22470 | Critical | 9.8 | 2025-08-06 | CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua scri… |
CVE-2025-52078 | Medium | 6.5 | 2025-08-05 | File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted… |
CVE-2014-125113 | | 2025-08-05 | An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849… | |
CVE-2013-10067 | | 2025-08-05 | Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administra… | |
CVE-2013-10066 | | 2025-08-05 | An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows… |