CWE-434 · Unrestricted Upload of File with Dangerous Type (page 12)
Page 12 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7412 | Medium | 6.3 | 2025-07-10 | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-34100 | | 2025-07-10 | An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upl… | |
CVE-2025-34097 | | 2025-07-10 | An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with… | |
CVE-2024-39752 | Medium | 6.8 | 2025-07-10 | IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could be vulnerable to malicious file upload by not validating the type of file uploaded to Explore Content. A… |
CVE-2025-7210 | Medium | 6.3 | 2025-07-09 | A vulnerability was found in code-projects/Fabian Ros Library Management System 2.0 and classified as critical. Affected by this issue is some unknown function… |
CVE-2025-34077 | | 2025-07-09 | An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary use… | |
CVE-2025-7190 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. This affects an unknown part of the file /admin/st… |
CVE-2025-0928 | High | 8.8 | 2025-07-08 | In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller… |
CVE-2025-7181 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Staff Audit System 1.0. Affected is an unknown function of the file /test.php. Th… |
CVE-2025-7175 | Medium | 6.3 | 2025-07-08 | A vulnerability was found in code-projects E-Commerce Site 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/users_ph… |
CVE-2025-27127 | Medium | 4.3 | 2025-07-08 | A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal… |
CVE-2025-7152 | Medium | 6.3 | 2025-07-08 | A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/candid… |
CVE-2025-7151 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-6802 | Critical | 9.8 | 2025-07-07 | Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2025-7124 | Medium | 6.3 | 2025-07-07 | A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprof… |
CVE-2025-7114 | High | 7.3 | 2025-07-07 | A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability i… |
CVE-2025-7100 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in BoyunCMS up to 1.4.20 and classified as critical. Affected by this issue is some unknown functionality of the file /application/us… |
CVE-2025-7075 | Medium | 6.3 | 2025-07-06 | A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-49414 | Critical | 10.0 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery… |
CVE-2025-30933 | Critical | 10.0 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue a… |
CVE-2025-28951 | Critical | 9.1 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.Th… |
CVE-2025-6586 | High | 7.2 | 2025-07-04 | The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_locInstall function in… |
CVE-2025-5322 | High | 7.2 | 2025-07-03 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updateca… |
CVE-2025-34086 | High | 8.8 | 2025-07-03 | Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with… |
CVE-2025-23968 | Critical | 9.1 | 2025-07-03 | Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issu… |
CVE-2025-5961 | High | 7.2 | 2025-07-03 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2025-5746 | Critical | 9.8 | 2025-07-02 | The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2025-6900 | Medium | 6.3 | 2025-06-30 | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-book.ph… |
CVE-2025-6873 | Medium | 4.7 | 2025-06-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Company Website 1.0. This issue affects some unknown processing of t… |
CVE-2025-6872 | Medium | 4.7 | 2025-06-29 | A vulnerability classified as critical was found in SourceCodester Simple Company Website 1.0. This vulnerability affects unknown code of the file /classes/Sys… |
CVE-2025-6870 | Medium | 4.7 | 2025-06-29 | A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-6848 | Medium | 6.3 | 2025-06-29 | A vulnerability, which was classified as critical, has been found in code-projects Simple Forum 1.0. This issue affects some unknown processing of the file /fo… |
CVE-2025-6843 | High | 7.3 | 2025-06-29 | A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been classified as critical. Affected is an unknown function of the file /upload-ph… |
CVE-2025-6837 | Medium | 6.3 | 2025-06-29 | A vulnerability classified as critical was found in code-projects Library System 1.0. Affected by this vulnerability is an unknown functionality of the file /p… |
CVE-2025-53260 | Critical | 9.1 | 2025-06-27 | Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Up… |
CVE-2025-49885 | Critical | 10.0 | 2025-06-27 | Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-… |
CVE-2014-0468 | Critical | 9.8 | 2025-06-26 | Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that the users would have uploaded in their raw SCM… |
CVE-2025-30131 | Critical | 9.8 | 2025-06-26 | An issue was discovered on IROAD Dashcam FX2 devices. An unauthenticated file upload endpoint can be leveraged to execute arbitrary commands by uploading a CGI… |
CVE-2025-34046 | | 2025-06-26 | An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/Uploa… | |
CVE-2025-6667 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2021-4457 | Critical | 9.1 | 2025-06-25 | The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server. |
CVE-2025-6435 | High | 8.1 | 2025-06-24 | If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file… |
CVE-2025-6206 | High | 7.5 | 2025-06-24 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads d… |
CVE-2025-36519 | Medium | 4.3 | 2025-06-24 | Unrestricted upload of file with dangerous type issue exists in WRC-2533GST2, WRC-1167GST2, WRC-2533GST2, WRC-2533GS2V-B,WRC-2533GS2-B v1.69 and earlier, WRC-2… |
CVE-2025-34040 | | 2025-06-24 | An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are imprope… | |
CVE-2025-6466 | Medium | 6.3 | 2025-06-22 | A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of t… |
CVE-2025-6422 | Medium | 6.3 | 2025-06-21 | A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-4102 | High | 7.2 | 2025-06-20 | The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabl… |
CVE-2025-6266 | Medium | 6.3 | 2025-06-19 | A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing ma… |
CVE-2025-23171 | High | 7.2 | 2025-06-19 | The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload p… |
CVE-2025-46157 | Critical | 9.9 | 2025-06-18 | An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form |
CVE-2025-6220 | High | 7.2 | 2025-06-18 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' func… |
CVE-2025-6086 | High | 7.2 | 2025-06-18 | The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all v… |
CVE-2025-4413 | High | 8.8 | 2025-06-18 | The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versi… |
CVE-2025-34511 | High | 8.8 | 2025-06-17 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricte… |
CVE-2025-47866 | Medium | 4.3 | 2025-06-17 | An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affe… |
CVE-2025-49447 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from… |
CVE-2025-49444 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server… |
CVE-2025-49071 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flo… |
CVE-2025-47559 | Critical | 9.9 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: f… |
CVE-2025-47452 | Critical | 9.9 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n… |
CVE-2025-32510 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue af… |
CVE-2025-3515 | High | 8.1 | 2025-06-17 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation… |
CVE-2025-6161 | High | 7.3 | 2025-06-17 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /ed… |
CVE-2025-3234 | High | 7.2 | 2025-06-14 | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and inc… |
CVE-2025-5012 | High | 8.8 | 2025-06-12 | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file ty… |
CVE-2025-6002 | High | 7.2 | 2025-06-11 | An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrar… |
CVE-2025-5395 | High | 8.8 | 2025-06-11 | The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in… |
CVE-2025-46612 | High | 7.2 | 2025-06-10 | The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestri… |
CVE-2025-4954 | High | 8.8 | 2025-06-10 | The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to uploa… |
CVE-2025-4387 | High | 8.8 | 2025-06-10 | The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add… |
CVE-2025-32291 | Critical | 10.0 | 2025-06-09 | Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO… |
CVE-2025-5873 | Medium | 6.3 | 2025-06-09 | A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of… |
CVE-2025-3835 | Critical | 9.6 | 2025-06-09 | Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module. |
CVE-2025-5840 | High | 7.3 | 2025-06-07 | A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file… |
CVE-2025-49329 | Medium | 6.6 | 2025-06-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Ser… |
CVE-2025-48782 | Critical | 9.8 | 2025-06-06 | An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version… |
CVE-2025-5728 | Medium | 6.3 | 2025-06-06 | A vulnerability classified as critical was found in SourceCodester Open Source Clinic Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2025-3054 | High | 8.8 | 2025-06-05 | The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all… |
CVE-2025-20130 | Medium | 4.9 | 2025-06-04 | A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote atta… |
CVE-2025-29093 | High | 8.2 | 2025-06-04 | File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images compon… |
CVE-2025-48953 | Medium | 5.5 | 2025-06-03 | Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that… |
CVE-2025-45855 | Medium | 5.4 | 2025-06-03 | An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading… |
CVE-2025-1725 | Medium | 6.4 | 2025-06-03 | The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… |
CVE-2024-7074 | Medium | 6.8 | 2025-06-02 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with… |
CVE-2025-5406 | Medium | 6.3 | 2025-06-01 | A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown f… |
CVE-2025-48889 | Medium | 5.3 | 2025-05-30 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |
CVE-2025-48471 | Critical | 9.8 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of fil… |
CVE-2025-46080 | Medium | 5.3 | 2025-05-29 | HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffi… |
CVE-2025-46078 | Medium | 5.3 | 2025-05-29 | HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server |
CVE-2025-45997 | High | 8.6 | 2025-05-28 | Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can upload a PHP file disguised as an image by m… |
CVE-2025-5299 | High | 7.3 | 2025-05-28 | A vulnerability was found in SourceCodester Client Database Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of… |
CVE-2025-4800 | High | 8.8 | 2025-05-28 | The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attach… |
CVE-2025-5178 | Medium | 6.3 | 2025-05-26 | A vulnerability classified as critical has been found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected is an unknown function of the file /adm/… |
CVE-2025-5171 | Medium | 6.3 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.do… |
CVE-2025-5162 | Medium | 6.3 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown function… |
CVE-2025-5131 | Medium | 4.7 | 2025-05-24 | A vulnerability was found in Tmall Demo up to 20250505. It has been declared as critical. This vulnerability affects the function uploadCategoryImage of the fi… |
CVE-2025-5130 | Medium | 4.7 | 2025-05-24 | A vulnerability was found in Tmall Demo up to 20250505. It has been classified as critical. This affects the function uploadProductImage of the file tmall/admi… |
CVE-2025-5058 | Critical | 9.8 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_image()… |
CVE-2025-4336 | High | 8.1 | 2025-05-24 | The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_file()… |