CWE-434 · Unrestricted Upload of File with Dangerous Type (page 15)
Page 15 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13544 | Medium | 4.8 | 2025-02-11 | The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitr… |
CVE-2025-1166 | Medium | 6.3 | 2025-02-11 | A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-1165 | High | 7.3 | 2025-02-11 | A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ash… |
CVE-2024-13011 | Critical | 9.8 | 2025-02-10 | The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image'… |
CVE-2024-57408 | High | 7.2 | 2025-02-10 | An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-57407 | High | 7.3 | 2025-02-10 | An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-57668 | High | 8.8 | 2025-02-06 | In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability. |
CVE-2025-1025 | High | 7.5 | 2025-02-05 | Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upl… |
CVE-2025-1028 | High | 8.1 | 2025-02-05 | The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all… |
CVE-2024-13723 | High | 7.2 | 2025-02-04 | The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload… |
CVE-2024-57968 | Critical | 9.9 | 2025-02-03 | Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsin… |
CVE-2024-57450 | Critical | 9.8 | 2025-02-03 | ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function. |
CVE-2025-24505 | | 2025-01-30 | This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially craf… | |
CVE-2024-55417 | Medium | 4.3 | 2025-01-30 | DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload… |
CVE-2025-23213 | High | 8.7 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files… |
CVE-2024-13448 | Critical | 9.8 | 2025-01-28 | The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' func… |
CVE-2025-0722 | Medium | 4.7 | 2025-01-27 | A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the… |
CVE-2025-0357 | Critical | 9.8 | 2025-01-25 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image… |
CVE-2025-24650 | Critical | 9.1 | 2025-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic… |
CVE-2025-0702 | Medium | 6.3 | 2025-01-24 | A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This vulnerability affects unknown code… |
CVE-2024-40693 | High | 8.0 | 2025-01-24 | IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attack… |
CVE-2024-25034 | High | 8.0 | 2025-01-24 | IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers ca… |
CVE-2024-55926 | High | 7.6 | 2025-01-23 | A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploitin… |
CVE-2025-23953 | Critical | 10.0 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2025-23942 | Critical | 9.1 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-23921 | Critical | 9.0 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web S… |
CVE-2025-23918 | Critical | 9.9 | 2025-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser smallerik-file-browser allows Upload a Web Shell to a We… |
CVE-2024-13091 | Critical | 9.8 | 2025-01-22 | The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload… |
CVE-2025-22723 | Critical | 9.1 | 2025-01-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scann… |
CVE-2024-51919 | Critical | 9.0 | 2025-01-21 | Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designe… |
CVE-2025-0582 | Medium | 4.7 | 2025-01-20 | A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig… |
CVE-2024-13333 | High | 7.5 | 2025-01-17 | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' funct… |
CVE-2024-40513 | Medium | 4.6 | 2025-01-16 | An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function. |
CVE-2025-0472 | High | 7.5 | 2025-01-16 | Information exposure in the PMB platform affecting versions 4.2.13 and earlier. This vulnerability allows an attacker to upload a file to the environment and e… |
CVE-2025-0471 | Critical | 9.9 | 2025-01-16 | Unrestricted file upload vulnerability in the PMB platform, affecting versions 4.0.10 and above. This vulnerability could allow an attacker to upload a file to… |
CVE-2024-13355 | Medium | 5.4 | 2025-01-16 | The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited file uploads due to insufficient file typ… |
CVE-2024-41454 | Medium | 6.5 | 2025-01-15 | An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitra… |
CVE-2025-22782 | Critical | 9.9 | 2025-01-15 | Unrestricted Upload of File with Dangerous Type vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Uploa… |
CVE-2024-57761 | High | 8.1 | 2025-01-15 | An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2024-48760 | Critical | 9.8 | 2025-01-14 | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi fi… |
CVE-2024-13171 | High | 7.8 | 2025-01-14 | Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthent… |
CVE-2025-0463 | Medium | 6.3 | 2025-01-14 | A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affected is an unknown fu… |
CVE-2025-0460 | High | 7.3 | 2025-01-14 | A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.ph… |
CVE-2025-0394 | High | 8.8 | 2025-01-14 | The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to m… |
CVE-2025-0057 | Medium | 4.8 | 2025-01-14 | SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo wi… |
CVE-2023-42248 | Medium | 6.5 | 2025-01-13 | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parame… |
CVE-2024-46479 | Critical | 9.9 | 2025-01-13 | Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, le… |
CVE-2025-0402 | Medium | 6.3 | 2025-01-13 | A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/… |
CVE-2025-0399 | Medium | 4.7 | 2025-01-12 | A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file… |
CVE-2024-42180 | Low | 1.6 | 2025-01-12 | HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double e… |
CVE-2025-22152 | Critical | 9.1 | 2025-01-10 | Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowin… |
CVE-2024-46210 | High | 7.2 | 2025-01-10 | An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-22504 | Critical | 10.0 | 2025-01-09 | Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-0346 | Medium | 4.7 | 2025-01-09 | A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/p… |
CVE-2025-0341 | Medium | 6.3 | 2025-01-09 | A vulnerability, which was classified as critical, has been found in CampCodes Computer Laboratory Management System 1.0. Affected by this issue is some unknow… |
CVE-2024-43662 | | 2025-01-09 | The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any user, although the user inte… | |
CVE-2024-43657 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2024-43656 | High | 8.8 | 2025-01-09 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability allows OS Command Injection as root This issue affects Iocha… |
CVE-2025-0335 | Medium | 6.3 | 2025-01-09 | A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of th… |
CVE-2024-13212 | Medium | 6.3 | 2025-01-09 | A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/hous… |
CVE-2024-13210 | Medium | 4.7 | 2025-01-09 | A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of… |
CVE-2024-13201 | Medium | 4.7 | 2025-01-09 | A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/mai… |
CVE-2024-13191 | Medium | 6.3 | 2025-01-08 | A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/w… |
CVE-2025-22137 | Critical | 9.8 | 2025-01-08 | Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anony… |
CVE-2024-12854 | High | 8.8 | 2025-01-08 | The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatical… |
CVE-2024-12853 | High | 8.8 | 2025-01-08 | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in al… |
CVE-2025-22133 | Critical | 9.9 | 2025-01-07 | WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/control… |
CVE-2025-22132 | High | 8.3 | 2025-01-07 | WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/htm… |
CVE-2022-41573 | Critical | 9.8 | 2025-01-07 | An issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading of executable files. A user can upload a .png file containing… |
CVE-2025-21624 | Critical | 9.8 | 2025-01-07 | ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the… |
CVE-2024-53345 | High | 8.8 | 2025-01-07 | An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a cr… |
CVE-2024-43243 | Critical | 10.0 | 2025-01-07 | Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This… |
CVE-2024-56828 | Critical | 9.8 | 2025-01-06 | File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base6… |
CVE-2024-13145 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com… |
CVE-2024-13144 | Medium | 6.3 | 2025-01-06 | A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/sit… |
CVE-2024-13138 | Medium | 4.7 | 2025-01-05 | A vulnerability was found in wangl1989 mysiteforme 1.0. It has been declared as critical. This vulnerability affects the function upload of the file src/main/j… |
CVE-2024-13134 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher of the file src/mai… |
CVE-2024-13133 | Medium | 6.3 | 2025-01-05 | A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the… |
CVE-2025-0213 | Medium | 6.3 | 2025-01-04 | A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /fo… |
CVE-2025-22389 | High | 8.0 | 2025-01-04 | An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not prop… |
CVE-2024-55078 | Critical | 9.8 | 2025-01-03 | An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uplo… |
CVE-2024-56264 | Medium | 6.6 | 2025-01-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector acf-city-selector allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-56249 | Critical | 9.1 | 2025-01-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-56829 | Critical | 10.0 | 2025-01-02 | Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element… |
CVE-2024-56064 | Critical | 10.0 | 2024-12-31 | Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This i… |
CVE-2024-56046 | Critical | 10.0 | 2024-12-31 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-13022 | Medium | 6.3 | 2024-12-29 | A vulnerability, which was classified as critical, was found in taisan tarzan-cms 1.0.0. This affects the function UploadResponse of the file src/main/java/com… |
CVE-2024-56508 | High | 7.6 | 2024-12-27 | LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the LinkAce. This issue occ… |
CVE-2024-12956 | Medium | 6.3 | 2024-12-26 | A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the fi… |
CVE-2024-12954 | Medium | 6.3 | 2024-12-26 | A vulnerability, which was classified as critical, was found in 1000 Projects Portfolio Management System MCA 1.0. This affects an unknown part of the file /up… |
CVE-2024-12953 | Medium | 6.3 | 2024-12-26 | A vulnerability, which was classified as critical, has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected by this issue is some unknown… |
CVE-2024-12951 | Medium | 6.3 | 2024-12-26 | A vulnerability classified as critical has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected is an unknown function of the file /add_pe… |
CVE-2024-47151 | Medium | 6.3 | 2024-12-26 | Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution |
CVE-2024-10584 | Medium | 5.4 | 2024-12-24 | The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all… |
CVE-2024-40695 | High | 8.0 | 2024-12-20 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validating the content of the… |
CVE-2024-12700 | High | 8.8 | 2024-12-19 | There is an unrestricted file upload vulnerability where it is possible for an authenticated user (low privileged) to upload an jsp shell and execute code with… |
CVE-2024-11984 | High | 8.8 | 2024-12-19 | A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote aut… |
CVE-2024-56057 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56054 | Critical | 9.1 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-56052 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |