CWE-434 · Unrestricted Upload of File with Dangerous Type (page 14)
Page 14 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29394 | High | 8.1 | 2025-04-09 | An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type. |
CVE-2025-27082 | High | 7.2 | 2025-04-08 | Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating system… |
CVE-2025-32028 | Critical | 9.9 | 2025-04-08 | HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ func… |
CVE-2025-3410 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-pla… |
CVE-2025-2525 | High | 8.8 | 2025-04-08 | The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_Controller::edit_profile… |
CVE-2025-3325 | Medium | 4.3 | 2025-04-06 | A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the com… |
CVE-2025-3324 | Medium | 6.3 | 2025-04-06 | A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality o… |
CVE-2025-32370 | High | 7.2 | 2025-04-06 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed… |
CVE-2025-1500 | Medium | 5.5 | 2025-04-05 | IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened. |
CVE-2025-32118 | Critical | 9.1 | 2025-04-04 | Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious… |
CVE-2025-3244 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability… |
CVE-2025-2780 | High | 8.8 | 2025-04-04 | The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeatu… |
CVE-2024-13708 | High | 7.2 | 2025-04-04 | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficie… |
CVE-2024-13744 | High | 8.1 | 2025-04-04 | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fiel… |
CVE-2025-3169 | Medium | 5.0 | 2025-04-03 | A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/save… |
CVE-2025-3123 | Medium | 4.7 | 2025-04-02 | A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the c… |
CVE-2025-2005 | Critical | 9.8 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registrat… |
CVE-2025-27692 | Medium | 4.7 | 2025-04-02 | Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker wi… |
CVE-2025-2891 | High | 8.8 | 2025-04-01 | The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.ph… |
CVE-2025-2008 | High | 8.8 | 2025-04-01 | The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import… |
CVE-2025-3042 | Medium | 6.3 | 2025-04-01 | A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. This vulnerability affects unknown code of the file /studen… |
CVE-2025-3041 | Medium | 6.3 | 2025-04-01 | A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /admin/update… |
CVE-2025-3040 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-31577 | Medium | 6.6 | 2025-03-31 | Unrestricted Upload of File with Dangerous Type vulnerability in appointify Appointify appointify allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2025-2978 | Medium | 6.3 | 2025-03-31 | A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/u… |
CVE-2025-2973 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/st… |
CVE-2025-2952 | Medium | 6.3 | 2025-03-30 | A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.ph… |
CVE-2025-2249 | High | 8.8 | 2025-03-29 | The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_options_subpanel()… |
CVE-2025-2006 | High | 8.8 | 2025-03-29 | The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading… |
CVE-2024-56975 | Critical | 9.8 | 2025-03-28 | InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Uplo… |
CVE-2025-2819 | Medium | 6.6 | 2025-03-26 | There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This… |
CVE-2025-2749 | High | 7.2 | 2025-03-24 | An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations… |
CVE-2025-2748 | Medium | 6.1 | 2025-03-24 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This… |
CVE-2025-2706 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/Uplo… |
CVE-2025-2705 | High | 7.3 | 2025-03-24 | A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. Th… |
CVE-2025-2702 | Medium | 6.3 | 2025-03-24 | A vulnerability, which was classified as critical, has been found in Softwin WMX3 3.1. This issue affects the function ImageAdd of the file /ImageAdd.ashx. The… |
CVE-2025-2687 | Medium | 6.3 | 2025-03-24 | A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the co… |
CVE-2025-2671 | Medium | 6.3 | 2025-03-23 | A vulnerability was found in Yue Lao Blind Box 月老盲盒 up to 4.0. It has been declared as critical. This vulnerability affects the function base64image of the fil… |
CVE-2025-2607 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functional… |
CVE-2025-2606 | Medium | 6.3 | 2025-03-21 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-29411 | Critical | 9.8 | 2025-03-20 | An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via u… |
CVE-2024-9920 | High | 8.8 | 2025-03-20 | In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones li… |
CVE-2024-8958 | Critical | 9.8 | 2025-03-20 | In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file p… |
CVE-2024-8019 | Critical | 9.1 | 2025-03-20 | In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `… |
CVE-2024-10901 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This v… |
CVE-2025-29405 | Medium | 6.3 | 2025-03-19 | An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via upl… |
CVE-2025-2512 | Critical | 9.8 | 2025-03-19 | The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload() f… |
CVE-2024-45644 | Medium | 4.7 | 2025-03-19 | IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's envir… |
CVE-2025-24801 | High | 8.5 | 2025-03-18 | GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. Th… |
CVE-2024-57169 | Critical | 9.8 | 2025-03-18 | A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass uplo… |
CVE-2025-2494 | Critical | 9.8 | 2025-03-18 | Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/p… |
CVE-2024-54525 | High | 8.8 | 2025-03-17 | A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS… |
CVE-2025-2396 | High | 8.8 | 2025-03-17 | The U-Office Force from e-Excellence has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and execute web sh… |
CVE-2025-2350 | Medium | 6.3 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-2219 | High | 7.3 | 2025-03-12 | A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/i… |
CVE-2025-2216 | Medium | 6.3 | 2025-03-12 | A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function… |
CVE-2025-28915 | Critical | 9.1 | 2025-03-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-22213 | | 2025-03-11 | Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potential… | |
CVE-2025-2115 | Medium | 6.3 | 2025-03-09 | A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of t… |
CVE-2024-13359 | High | 8.1 | 2025-03-08 | The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_produ… |
CVE-2024-13882 | High | 8.8 | 2025-03-08 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads d… |
CVE-2024-13908 | High | 7.2 | 2025-03-08 | The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all… |
CVE-2025-25361 | Critical | 9.8 | 2025-03-06 | An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code… |
CVE-2025-2035 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-2031 | Medium | 6.3 | 2025-03-06 | A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. Th… |
CVE-2025-27411 | Medium | 5.4 | 2025-03-05 | REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3. |
CVE-2025-27683 | High | 8.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File with Dangerous Type… |
CVE-2025-26319 | Critical | 9.8 | 2025-03-04 | FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. |
CVE-2024-47259 | Low | 3.5 | 2025-03-04 | Girishunawane, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi did not have a sufficient input validation allowing fo… |
CVE-2025-1890 | Medium | 6.3 | 2025-03-04 | A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/co… |
CVE-2025-1835 | Medium | 6.3 | 2025-03-02 | A vulnerability has been found in osuuu LightPicture 1.2.2 and classified as critical. This vulnerability affects the function upload of the file /app/controll… |
CVE-2025-1834 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, was found in zj1983 zz up to 2024-8. This affects an unknown part of the file /resolve. The manipulation of… |
CVE-2025-1818 | Medium | 6.3 | 2025-03-02 | A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/ja… |
CVE-2025-1791 | Medium | 6.3 | 2025-03-01 | A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaij… |
CVE-2024-8425 | Critical | 9.8 | 2025-02-28 | The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_previe… |
CVE-2025-26325 | Critical | 9.8 | 2025-02-27 | ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php. |
CVE-2024-41340 | High | 8.4 | 2025-02-27 | An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9… |
CVE-2024-41339 | High | 8.8 | 2025-02-27 | An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2… |
CVE-2025-25790 | Critical | 9.8 | 2025-02-26 | An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading… |
CVE-2025-25784 | Critical | 9.8 | 2025-02-26 | An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a… |
CVE-2025-25783 | Critical | 9.8 | 2025-02-26 | An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2025-0731 | Medium | 6.5 | 2025-02-26 | An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the securi… |
CVE-2025-1128 | Critical | 9.8 | 2025-02-25 | The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, r… |
CVE-2025-1646 | High | 7.3 | 2025-02-25 | A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of the file /Api/TinyM… |
CVE-2024-56897 | Critical | 9.8 | 2025-02-24 | Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made… |
CVE-2025-1598 | Medium | 6.3 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2025-1593 | Medium | 4.7 | 2025-02-23 | A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /_hr_soft… |
CVE-2025-1590 | Medium | 4.7 | 2025-02-23 | A vulnerability was found in SourceCodester E-Learning System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modul… |
CVE-2025-26776 | Critical | 10.0 | 2025-02-22 | Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Chaty Pro allows Upload a Web Shell to a Web Server. This issue affects Chaty Pro: fr… |
CVE-2024-13869 | High | 7.2 | 2025-02-22 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2025-1555 | High | 7.3 | 2025-02-21 | A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipu… |
CVE-2025-22654 | Critical | 10.0 | 2025-02-18 | Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious Files.This issue affects Simplified: fro… |
CVE-2025-1388 | High | 8.8 | 2025-02-17 | Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells |
CVE-2025-1355 | High | 7.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-1070 | High | 8.1 | 2025-02-13 | CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded. |
CVE-2025-26350 | Medium | 4.9 | 2025-02-12 | A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authe… |
CVE-2024-10960 | Critical | 9.9 | 2025-02-12 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all… |
CVE-2024-13365 | Critical | 9.8 | 2025-02-12 | The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extracting .zip archives… |
CVE-2024-13714 | High | 8.8 | 2025-02-12 | The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2025-26411 | High | 8.8 | 2025-02-11 | An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device… |