CWE-434 · Unrestricted Upload of File with Dangerous Type (page 11)
Page 11 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2012-10030 | Critical | 9.8 | 2025-08-05 | FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system director… |
CVE-2012-10027 | | 2025-08-05 | WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` sc… | |
CVE-2012-10026 | | 2025-08-05 | The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to p… | |
CVE-2025-6207 | High | 7.5 | 2025-08-05 | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_tempalte_import' functi… |
CVE-2025-5061 | High | 7.5 | 2025-08-05 | The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' func… |
CVE-2025-8526 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/… |
CVE-2025-52239 | Critical | 9.8 | 2025-08-04 | An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file. |
CVE-2013-10054 | | 2025-08-04 | An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file up… | |
CVE-2025-54962 | Medium | 6.4 | 2025-08-04 | /edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then p… |
CVE-2025-8504 | Medium | 6.3 | 2025-08-03 | A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration… |
CVE-2013-10055 | | 2025-08-01 | An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fa… | |
CVE-2013-10047 | | 2025-08-01 | An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to… | |
CVE-2013-10044 | High | 8.8 | 2025-08-01 | An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and… |
CVE-2025-44139 | High | 7.2 | 2025-08-01 | Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip |
CVE-2025-7443 | High | 8.1 | 2025-08-01 | The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to ar… |
CVE-2014-125126 | | 2025-07-31 | An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by s… | |
CVE-2013-10043 | | 2025-07-31 | A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to… | |
CVE-2013-10040 | Critical | 9.8 | 2025-07-31 | ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoi… |
CVE-2013-10038 | | 2025-07-31 | An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly va… | |
CVE-2013-10034 | | 2025-07-31 | An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to uplo… | |
CVE-2025-8379 | Medium | 4.7 | 2025-07-31 | A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_ro… |
CVE-2025-54757 | Medium | 6.5 | 2025-07-31 | Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an… |
CVE-2025-7847 | High | 8.8 | 2025-07-31 | The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versi… |
CVE-2025-8344 | Medium | 6.3 | 2025-07-31 | A vulnerability classified as critical has been found in openviglet shio up to 0.3.8. Affected is the function shStaticFileUpload of the file shio-app/src/main… |
CVE-2025-8323 | High | 8.8 | 2025-07-30 | The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereb… |
CVE-2025-54769 | High | 8.8 | 2025-07-29 | An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This ca… |
CVE-2025-8265 | Medium | 4.7 | 2025-07-28 | A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component Fil… |
CVE-2025-8256 | Medium | 6.3 | 2025-07-28 | A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.p… |
CVE-2025-8255 | High | 7.3 | 2025-07-28 | A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /reg… |
CVE-2025-8174 | Medium | 6.3 | 2025-07-26 | A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admi… |
CVE-2025-8171 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing o… |
CVE-2025-52449 | High | 8.5 | 2025-07-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alter… |
CVE-2016-15046 | | 2025-07-25 | A client-side remote code execution vulnerability exists in Hanwha Techwin Smart Security Manager (SSM) versions 1.32 and 1.4, due to improper restrictions on… | |
CVE-2014-125119 | | 2025-07-25 | A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Dir… | |
CVE-2014-125116 | | 2025-07-25 | A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script… | |
CVE-2013-10032 | High | 8.8 | 2025-07-25 | An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to… |
CVE-2025-5831 | High | 8.8 | 2025-07-25 | The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all ve… |
CVE-2025-8128 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a65228476290949e0413de48f7fbe98. This issue affects some unkno… |
CVE-2015-10144 | High | 8.8 | 2025-07-25 | The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploade… |
CVE-2025-5243 | Critical | 10.0 | 2025-07-24 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SM… |
CVE-2025-7852 | Critical | 9.8 | 2025-07-24 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… |
CVE-2025-7437 | Critical | 9.8 | 2025-07-24 | The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function in all v… |
CVE-2025-47187 | High | 7.5 | 2025-07-23 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4… |
CVE-2025-46099 | High | 7.2 | 2025-07-23 | In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routi… |
CVE-2025-40599 | Critical | 9.1 | 2025-07-23 | An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges ca… |
CVE-2018-25114 | | 2025-07-23 | A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication… | |
CVE-2025-54449 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54448 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54447 | High | 8.1 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54444 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54442 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54441 | High | 8.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54440 | Critical | 9.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2025-54439 | High | 8.8 | 2025-07-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Se… |
CVE-2015-10137 | Critical | 9.8 | 2025-07-22 | The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file(… |
CVE-2012-10020 | Critical | 9.8 | 2025-07-22 | The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and… |
CVE-2025-7939 | Medium | 6.3 | 2025-07-21 | A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsCo… |
CVE-2025-54071 | | 2025-07-21 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and bel… | |
CVE-2025-7931 | High | 7.3 | 2025-07-21 | A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of t… |
CVE-2025-54082 | | 2025-07-21 | marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-pack… | |
CVE-2025-32744 | Medium | 6.6 | 2025-07-21 | Dell AppSync, version(s) 4.6.0.0, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access coul… |
CVE-2025-44658 | Critical | 9.8 | 2025-07-21 | In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An att… |
CVE-2025-7917 | High | 7.2 | 2025-07-21 | WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to u… |
CVE-2025-7906 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src… |
CVE-2025-7898 | Medium | 4.7 | 2025-07-20 | A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSett… |
CVE-2025-7895 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file a… |
CVE-2025-46384 | High | 8.8 | 2025-07-20 | CWE-434 Unrestricted Upload of File with Dangerous Type |
CVE-2025-7880 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /bu… |
CVE-2025-7879 | Medium | 6.3 | 2025-07-20 | A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-7878 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/uplo… |
CVE-2025-7877 | Medium | 6.3 | 2025-07-20 | A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file… |
CVE-2025-7864 | Medium | 6.3 | 2025-07-20 | A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/… |
CVE-2015-10138 | Critical | 9.8 | 2025-07-19 | The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0… |
CVE-2016-15043 | Critical | 9.8 | 2025-07-19 | The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, a… |
CVE-2015-10135 | Critical | 9.8 | 2025-07-19 | The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versio… |
CVE-2012-10019 | Critical | 9.8 | 2025-07-19 | The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions befor… |
CVE-2025-46001 | Critical | 9.8 | 2025-07-18 | An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a… |
CVE-2025-7438 | High | 7.5 | 2025-07-18 | The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plug… |
CVE-2025-6222 | Critical | 9.8 | 2025-07-18 | The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploa… |
CVE-2025-7755 | Medium | 6.3 | 2025-07-17 | A vulnerability was found in code-projects Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /a… |
CVE-2025-34121 | | 2025-07-16 | An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The `wizards/post2file.php`… | |
CVE-2025-20274 | Medium | 6.3 | 2025-07-16 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary fi… |
CVE-2025-48300 | Critical | 9.1 | 2025-07-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg groundhogg allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2025-29009 | Critical | 10.0 | 2025-07-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-… |
CVE-2025-34111 | Critical | 9.8 | 2025-07-15 | An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connecto… |
CVE-2025-34104 | | 2025-07-15 | An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versio… | |
CVE-2025-7340 | Critical | 9.8 | 2025-07-15 | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to mis… |
CVE-2025-53891 | Medium | 4.3 | 2025-07-15 | The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE website where uploade… |
CVE-2025-7627 | Medium | 6.3 | 2025-07-14 | A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue… |
CVE-2025-7547 | High | 7.3 | 2025-07-13 | A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects the function save_movi… |
CVE-2025-7538 | High | 7.3 | 2025-07-13 | A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/produc… |
CVE-2025-7487 | Medium | 6.3 | 2025-07-12 | A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects t… |
CVE-2025-7477 | Medium | 4.7 | 2025-07-12 | A vulnerability, which was classified as critical, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of… |
CVE-2020-36849 | Critical | 9.8 | 2025-07-12 | The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-i… |
CVE-2025-7470 | High | 7.3 | 2025-07-12 | A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/p… |
CVE-2020-36847 | Critical | 9.8 | 2025-07-12 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be u… |
CVE-2025-6423 | High | 8.8 | 2025-07-12 | The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_submit_upload_file() f… |
CVE-2025-6058 | Critical | 9.8 | 2025-07-12 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… |
CVE-2025-6057 | High | 8.8 | 2025-07-12 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all vers… |
CVE-2025-7413 | Medium | 6.3 | 2025-07-10 | A vulnerability classified as critical has been found in code-projects Library System 1.0. This affects an unknown part of the file /user/teacher/profile.php… |