CWE-434 · Unrestricted Upload of File with Dangerous Type (page 13)
Page 13 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5108 | Medium | 6.3 | 2025-05-23 | A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Pay… |
CVE-2025-47687 | Critical | 10.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web S… |
CVE-2025-47663 | Critical | 9.9 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web Shell to a Web Server. This issue affe… |
CVE-2025-47658 | Critical | 9.9 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-suppor… |
CVE-2025-47642 | Critical | 10.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web… |
CVE-2025-47641 | Critical | 10.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows… |
CVE-2025-47637 | Critical | 10.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in STAGGS STAGGS staggs allows Upload a Web Shell to a Web Server.This issue affects STAGGS: from… |
CVE-2025-46490 | Critical | 9.9 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Upload a Web Shel… |
CVE-2025-31916 | Critical | 9.0 | 2025-05-23 | Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Serv… |
CVE-2025-30173 | Medium | 6.7 | 2025-05-22 | File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03… |
CVE-2025-30169 | Medium | 6.7 | 2025-05-22 | File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT… |
CVE-2025-3444 | Medium | 6.5 | 2025-05-22 | Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin… |
CVE-2024-9544 | Medium | 6.4 | 2025-05-22 | The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficie… |
CVE-2025-5059 | Medium | 4.7 | 2025-05-21 | A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. This affects an unknown part of the file /admin/edit-subcategory… |
CVE-2025-47939 | Medium | 5.4 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allo… |
CVE-2025-39402 | Critical | 9.9 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2025-39401 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2025-39380 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System hospital-management allows Upload a Web Shell to a Web Ser… |
CVE-2025-47577 | Critical | 10.0 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to… |
CVE-2025-26892 | Critical | 9.9 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/… |
CVE-2025-26872 | Critical | 9.9 | 2025-05-19 | Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2. |
CVE-2025-4926 | Medium | 4.7 | 2025-05-19 | A vulnerability was found in PHPGurukul Car Rental Project 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /ad… |
CVE-2025-4923 | High | 7.3 | 2025-05-19 | A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown proc… |
CVE-2025-4391 | Critical | 9.8 | 2025-05-17 | The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the echo_generate_featured… |
CVE-2025-4389 | Critical | 9.8 | 2025-05-17 | The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlo… |
CVE-2025-4768 | Medium | 6.3 | 2025-05-16 | A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file… |
CVE-2025-4735 | Medium | 6.3 | 2025-05-16 | A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2025-47787 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a cri… |
CVE-2025-3917 | Critical | 9.8 | 2025-05-15 | The 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download_remote_image_… |
CVE-2025-4648 | High | 8.4 | 2025-05-13 | The content of a SVG file, received as input in Centreon web, was not properly checked. Allows Reflected XSS. A user with elevated privileges can inject JS s… |
CVE-2025-4317 | High | 8.8 | 2025-05-13 | The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegem_get_logo_url() function in all version… |
CVE-2025-4561 | High | 8.8 | 2025-05-12 | The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, t… |
CVE-2025-4556 | Critical | 9.8 | 2025-05-12 | The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote atta… |
CVE-2025-4538 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of th… |
CVE-2025-46193 | Critical | 9.8 | 2025-05-09 | SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in user_proposal_update_order.php. |
CVE-2025-4403 | Critical | 9.8 | 2025-05-09 | The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.1.6… |
CVE-2025-4468 | High | 7.3 | 2025-05-09 | A vulnerability was found in SourceCodester Online Student Clearance System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-3455 | High | 8.8 | 2025-05-09 | The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2024-11617 | Critical | 9.8 | 2025-05-09 | The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetra_languageUpload' and 'zetra_fo… |
CVE-2023-31585 | Critical | 9.8 | 2025-05-08 | Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php. |
CVE-2025-47550 | Medium | 6.6 | 2025-05-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Inst… |
CVE-2025-47549 | Critical | 9.1 | 2025-05-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-0984 | High | 8.2 | 2025-05-06 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in N… |
CVE-2025-40625 | Critical | 9.8 | 2025-05-06 | Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file… |
CVE-2025-4333 | Medium | 6.3 | 2025-05-06 | A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFil… |
CVE-2025-4310 | Medium | 4.7 | 2025-05-06 | A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. This affects an unknown part of the file /admin/add_topic… |
CVE-2025-4305 | Medium | 6.3 | 2025-05-06 | A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/co… |
CVE-2025-4291 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted… |
CVE-2025-4279 | High | 8.8 | 2025-05-05 | The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external_image_replace_get_… |
CVE-2024-51991 | Medium | 4.9 | 2025-05-05 | October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrators with sites that… |
CVE-2025-28168 | Medium | 6.4 | 2025-05-05 | The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validatio… |
CVE-2025-4259 | Medium | 6.3 | 2025-05-05 | A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall… |
CVE-2025-4258 | Medium | 6.3 | 2025-05-05 | A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master… |
CVE-2024-13418 | High | 8.8 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in va… |
CVE-2025-25016 | Medium | 4.3 | 2025-05-01 | Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient… |
CVE-2024-11390 | Medium | 5.4 | 2025-05-01 | Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScr… |
CVE-2022-42449 | Medium | 4.6 | 2025-04-30 | Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications |
CVE-2022-27562 | Medium | 4.6 | 2025-04-30 | Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. |
CVE-2025-0520 | | 2025-04-29 | An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code… | |
CVE-2025-4006 | Medium | 4.7 | 2025-04-28 | A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the c… |
CVE-2025-3969 | Medium | 6.3 | 2025-04-27 | A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2025-3914 | High | 8.8 | 2025-04-26 | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_download… |
CVE-2025-46616 | Critical | 9.9 | 2025-04-25 | Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. This affects StorNext RYO before 7.2.4… |
CVE-2022-44760 | Medium | 4.6 | 2025-04-24 | Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications. |
CVE-2025-31324 | Critical | 10.0 | 2025-04-24 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious ex… |
CVE-2025-46264 | Critical | 9.9 | 2025-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-43946 | Critical | 9.8 | 2025-04-22 | TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal). |
CVE-2025-3616 | High | 8.8 | 2025-04-22 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb… |
CVE-2025-29287 | Critical | 9.8 | 2025-04-21 | An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-3830 | Medium | 6.3 | 2025-04-20 | A vulnerability was found in kuangstudy KuangSimpleBBS 1.0. It has been declared as critical. Affected by this vulnerability is the function fileUpload of the… |
CVE-2025-3807 | Medium | 6.3 | 2025-04-19 | A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/co… |
CVE-2025-3798 | Medium | 4.7 | 2025-04-19 | A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php… |
CVE-2021-4455 | Critical | 9.8 | 2025-04-19 | The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up t… |
CVE-2025-1093 | Critical | 9.8 | 2025-04-19 | The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the generate_image function in all versions up to… |
CVE-2025-3783 | Medium | 6.3 | 2025-04-18 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unkno… |
CVE-2025-3765 | Medium | 6.3 | 2025-04-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |
CVE-2025-3764 | Medium | 6.3 | 2025-04-17 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of… |
CVE-2025-39436 | Critical | 9.1 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <… |
CVE-2025-32682 | Critical | 9.9 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server… |
CVE-2025-32660 | Critical | 10.0 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in JoomSky JS Job Manager js-jobs allows Upload a Web Shell to a Web Server.This issue affects JS… |
CVE-2025-32652 | Critical | 9.9 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra solace-extra allows Using Malicious Files.This issue affects Solace Extr… |
CVE-2025-27282 | Critical | 9.9 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows Using Malicious Files.This issue… |
CVE-2025-31339 | | 2025-04-17 | An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote… | |
CVE-2024-40071 | Critical | 9.8 | 2025-04-16 | Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/SystemSettings.php?f=up… |
CVE-2025-39557 | Critical | 9.1 | 2025-04-16 | Unrestricted Upload of File with Dangerous Type vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Upload… |
CVE-2025-39538 | Medium | 6.6 | 2025-04-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Serv… |
CVE-2025-1980 | | 2025-04-16 | The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was… | |
CVE-2025-26927 | Critical | 10.0 | 2025-04-15 | Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes AI Hub aihub allows Upload a Web Shell to a Web Server.This issue affects AI Hub… |
CVE-2025-3593 | Medium | 6.3 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of th… |
CVE-2025-3585 | Medium | 6.3 | 2025-04-14 | A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser… |
CVE-2025-3566 | High | 7.3 | 2025-04-14 | A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discu… |
CVE-2025-3565 | Medium | 4.7 | 2025-04-14 | A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uplo… |
CVE-2025-3558 | Medium | 6.3 | 2025-04-14 | A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHead… |
CVE-2025-32579 | Critical | 9.9 | 2025-04-11 | Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts sync-posts allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-29017 | High | 8.8 | 2025-04-10 | A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parame… |
CVE-2025-32215 | Medium | 6.5 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Stored XSS.This issue affects Acc… |
CVE-2025-32206 | Critical | 9.1 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This… |
CVE-2025-32202 | Critical | 9.1 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Brian Batt - elearningfreak.com Insert or Embed Articulate Content into WordPress insert-or-em… |
CVE-2025-32140 | Critical | 9.9 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail wp-remote-thumbnail allows Upload a Web Shell to a Web Se… |
CVE-2025-31002 | Critical | 9.1 | 2025-04-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: fro… |