CWE-434 · Unrestricted Upload of File with Dangerous Type (page 16)
Page 16 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-56050 | Critical | 9.9 | 2024-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPL… |
CVE-2024-55514 | Medium | 6.3 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_sfmig.php on the web interf… |
CVE-2024-54285 | Critical | 9.1 | 2024-12-16 | Unrestricted Upload of File with Dangerous Type vulnerability in SeedProd LLC SeedProd Pro allows Upload a Web Shell to a Web Server.This issue affects SeedPro… |
CVE-2024-54370 | Critical | 9.9 | 2024-12-16 | Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Uplo… |
CVE-2024-12478 | Medium | 6.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index… |
CVE-2024-9698 | High | 7.2 | 2024-12-14 | The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'process_uploaded_files' fun… |
CVE-2024-54262 | Critical | 9.9 | 2024-12-13 | Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell t… |
CVE-2024-9290 | Critical | 9.8 | 2024-12-13 | The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing… |
CVE-2024-12042 | Medium | 5.4 | 2024-12-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload… |
CVE-2024-10590 | High | 8.8 | 2024-12-12 | The Opt-In Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_upload() function in all ver… |
CVE-2024-44220 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. Parsing a maliciously crafted video file… |
CVE-2024-53677 | Critical | 9.8 | 2024-12-11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lea… |
CVE-2024-47946 | High | 7.2 | 2024-12-10 | If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content… |
CVE-2024-50625 | High | 8.0 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file pat… |
CVE-2024-54918 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php. |
CVE-2024-53822 | Critical | 10.0 | 2024-12-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. |
CVE-2024-54214 | Critical | 10.0 | 2024-12-06 | Unrestricted Upload of File with Dangerous Type vulnerability in roninwp Revy revy allows Upload a Web Shell to a Web Server.This issue affects Revy: from n/a… |
CVE-2024-53811 | Medium | 6.6 | 2024-12-06 | Unrestricted Upload of File with Dangerous Type vulnerability in POSIMYTH WDesignkit wdesignkit allows Upload a Web Shell to a Web Server.This issue affects WD… |
CVE-2024-10578 | High | 8.8 | 2024-12-06 | The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_ac… |
CVE-2024-12233 | High | 7.3 | 2024-12-05 | A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /re… |
CVE-2024-51548 | Critical | 9.9 | 2024-12-05 | Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRI… |
CVE-2024-53982 | | 2024-12-04 | ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo examp… | |
CVE-2024-40744 | Critical | 9.8 | 2024-12-04 | Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8. |
CVE-2024-46625 | High | 8.8 | 2024-12-03 | An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers to execute arbitrary… |
CVE-2024-25020 | Medium | 5.5 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to malicious file upload by allowing unrestricted filetype attachments in the Journal entry… |
CVE-2024-53863 | Critical | 9.1 | 2024-12-03 | Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted reque… |
CVE-2024-40691 | High | 8.0 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface… |
CVE-2024-25019 | Medium | 5.5 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments… |
CVE-2024-11391 | High | 7.5 | 2024-12-03 | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' fi… |
CVE-2024-53564 | Low | 2.2 | 2024-12-02 | A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrat… |
CVE-2024-52476 | Critical | 10.0 | 2024-12-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Stefan Bohacek Fediverse Embeds fediverse-embeds allows Upload a Web Shell to a Web Server.Thi… |
CVE-2024-11979 | Critical | 9.8 | 2024-11-29 | DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to… |
CVE-2024-11971 | Low | 3.5 | 2024-11-28 | A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-52490 | Critical | 10.0 | 2024-11-28 | Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-11082 | Critical | 9.9 | 2024-11-28 | The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() funct… |
CVE-2024-8066 | High | 7.5 | 2024-11-28 | The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all ver… |
CVE-2024-53619 | Medium | 6.3 | 2024-11-26 | An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-9504 | High | 7.2 | 2024-11-26 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to… |
CVE-2024-11674 | Medium | 6.3 | 2024-11-26 | A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/… |
CVE-2024-11661 | Medium | 4.3 | 2024-11-25 | A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown cod… |
CVE-2024-9942 | Critical | 9.8 | 2024-11-23 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_use… |
CVE-2024-9660 | High | 8.8 | 2024-11-23 | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load… |
CVE-2024-9659 | Critical | 9.8 | 2024-11-23 | The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_user… |
CVE-2024-51366 | Critical | 9.8 | 2024-11-21 | An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .con… |
CVE-2024-51364 | High | 8.8 | 2024-11-21 | An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. |
CVE-2024-8525 | | 2024-11-21 | An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a… | |
CVE-2024-52677 | Critical | 9.8 | 2024-11-20 | HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php. |
CVE-2024-52769 | High | 7.2 | 2024-11-20 | An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a cra… |
CVE-2024-51208 | High | 7.2 | 2024-11-20 | File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the I… |
CVE-2024-11404 | Medium | 5.5 | 2024-11-20 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Asso… |
CVE-2024-51743 | High | 8.8 | 2024-11-18 | MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the upd… |
CVE-2024-51499 | High | 8.8 | 2024-11-18 | MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability accessible… |
CVE-2024-52429 | Critical | 9.9 | 2024-11-18 | Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This iss… |
CVE-2024-11315 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11314 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11313 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11312 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11311 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-52397 | Critical | 9.1 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post convert-docx2post allows Upload a Web Shell to a Web Server… |
CVE-2024-52408 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in pushassist Push Notifications for WordPress by PushAssist push-notification-for-wp-by-pushassi… |
CVE-2024-52407 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in BasePress BasePress Migration Tools basepress-migration-tools allows Upload a Web Shell to a W… |
CVE-2024-52406 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in wibergsweb CSV to html csv-to-html allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2024-52405 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in bikramjoshii B-Banner Slider b-banner-slider allows Upload a Web Shell to a Web Server.This is… |
CVE-2024-52404 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in bigfiveagency CF7 Reply Manager cf7-reply-manager.This issue affects CF7 Reply Manager: from n… |
CVE-2024-52403 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issu… |
CVE-2024-52400 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Subhasis Laha Gallerio gallerio allows Upload a Web Shell to a Web Server.This issue affects G… |
CVE-2024-52399 | Critical | 9.9 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper writer-helper allows Upload a Web Shell to a Web Server.This issue a… |
CVE-2024-52398 | Critical | 9.1 | 2024-11-16 | Unrestricted Upload of File with Dangerous Type vulnerability in Halyra CDI collect-and-deliver-interface-for-woocommerce.This issue affects CDI: from n/a thro… |
CVE-2024-8856 | Critical | 9.8 | 2024-11-16 | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHan… |
CVE-2024-9849 | High | 8.8 | 2024-11-16 | The Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… |
CVE-2024-50652 | Medium | 4.3 | 2024-11-15 | A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function. |
CVE-2024-52370 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support hive-support allows Upload a Web Shell to a Web Server.This issue af… |
CVE-2024-52369 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KB… |
CVE-2024-52384 | Critical | 9.9 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation ai-content-gen… |
CVE-2024-52380 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-52379 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in faizalbahasan kineticPay for WooCommerce kineticpay-for-woocommerce allows Upload a Web Shell… |
CVE-2024-52377 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in bdthemes Instant Image Generator ai-image allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-52376 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a We… |
CVE-2024-52375 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative datasets-manager-by-arttia-creative.This i… |
CVE-2024-52374 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in DoThatTask Do That Task do-that-task allows Upload a Web Shell to a Web Server.This issue affe… |
CVE-2024-52373 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Team Devexhub Devexhub Gallery devexhub-gallery allows Upload a Web Shell to a Web Server.This… |
CVE-2024-52372 | Critical | 10.0 | 2024-11-14 | Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Serv… |
CVE-2024-52302 | | 2024-11-14 | common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical… | |
CVE-2024-11214 | Medium | 4.7 | 2024-11-14 | A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-11211 | Medium | 4.7 | 2024-11-14 | A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipu… |
CVE-2024-10820 | Critical | 9.8 | 2024-11-13 | The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in… |
CVE-2024-11138 | Low | 2.7 | 2024-11-12 | A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. Th… |
CVE-2024-11122 | Medium | 6.3 | 2024-11-12 | A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functional… |
CVE-2024-11018 | Critical | 9.8 | 2024-11-11 | Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which c… |
CVE-2024-11017 | High | 8.8 | 2024-11-11 | Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells… |
CVE-2024-51793 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Upload a Web Shell to a Web Server.This i… |
CVE-2024-51792 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Dang Ngoc Binh Audio Record audio-record allows Upload a Web Shell to a Web Server.This issue… |
CVE-2024-51791 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects… |
CVE-2024-51790 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in HB WEBSOL HB AUDIO GALLERY hb-audio-gallery allows Upload a Web Shell to a Web Server.This iss… |
CVE-2024-51789 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in UjW0L Image Classify image-classify allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2024-51788 | Critical | 10.0 | 2024-11-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory noveldesign-store-directory allows Upload a Web… |
CVE-2024-11054 | Medium | 6.3 | 2024-11-10 | A vulnerability classified as critical was found in SourceCodester Simple Music Cloud Community System 1.0. This vulnerability affects unknown code of the file… |
CVE-2024-10801 | Critical | 9.8 | 2024-11-09 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_… |
CVE-2024-10547 | Critical | 9.8 | 2024-11-09 | The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function… |
CVE-2024-10627 | Critical | 9.8 | 2024-11-09 | The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_… |