CWE-434 · Unrestricted Upload of File with Dangerous Type (page 18)
Page 18 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47423 | High | 7.8 | 2024-10-09 | Adobe Framemaker versions 2020.6, 2022.4 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbi… |
CVE-2024-45137 | High | 7.8 | 2024-10-09 | InDesign Desktop versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitr… |
CVE-2024-45136 | High | 7.8 | 2024-10-09 | InCopy versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code e… |
CVE-2024-47823 | Critical | 9.8 | 2024-10-08 | Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`… |
CVE-2024-37179 | High | 7.7 | 2024-10-08 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to… |
CVE-2024-47319 | High | 8.0 | 2024-10-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form bit-form.This issue affects Bit Form: from n/a through <= 2.13.10. |
CVE-2024-9417 | Medium | 6.1 | 2024-10-05 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleU… |
CVE-2024-8743 | Medium | 6.8 | 2024-10-05 | The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload… |
CVE-2024-37869 | High | 8.8 | 2024-10-04 | File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "poster.php" file, a… |
CVE-2024-37868 | High | 8.8 | 2024-10-04 | File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "sendreply.php" file… |
CVE-2024-47655 | High | 8.8 | 2024-10-04 | This vulnerability exists in the Shilpi Client Dashboard due to improper validation of files being uploaded other than the specified extension. An authenticate… |
CVE-2024-45965 | Medium | 6.4 | 2024-10-02 | Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and… |
CVE-2024-7855 | High | 8.8 | 2024-10-02 | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all ve… |
CVE-2024-47528 | Medium | 4.8 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for… |
CVE-2024-9108 | Critical | 9.8 | 2024-10-01 | The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_lo… |
CVE-2024-46441 | High | 8.8 | 2024-09-27 | An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php… |
CVE-2024-9280 | Medium | 4.7 | 2024-09-27 | A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the… |
CVE-2024-9278 | Medium | 4.7 | 2024-09-27 | A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verificat… |
CVE-2024-47169 | High | 8.8 | 2024-09-26 | Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to up… |
CVE-2024-8725 | Medium | 6.8 | 2024-09-26 | Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-… |
CVE-2024-8126 | High | 7.5 | 2024-09-26 | The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and includ… |
CVE-2024-7772 | Critical | 9.8 | 2024-09-26 | The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all vers… |
CVE-2024-8940 | Critical | 10.0 | 2024-09-25 | Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery… |
CVE-2023-26690 | High | 8.8 | 2024-09-25 | File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin… |
CVE-2023-26686 | Critical | 9.8 | 2024-09-25 | File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop. |
CVE-2024-46101 | Critical | 9.8 | 2024-09-20 | GDidees CMS <= v3.9.1 has a file upload vulnerability. |
CVE-2024-9038 | Medium | 4.3 | 2024-09-20 | A vulnerability classified as problematic was found in Codezips Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-9036 | Medium | 6.3 | 2024-09-20 | A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_add… |
CVE-2024-40125 | Critical | 9.8 | 2024-09-19 | An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code v… |
CVE-2024-46377 | Critical | 9.8 | 2024-09-18 | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php. |
CVE-2024-46373 | High | 8.8 | 2024-09-18 | Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend. |
CVE-2024-45398 | High | 8.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. U… |
CVE-2024-8242 | Medium | 4.3 | 2024-09-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation… |
CVE-2024-27115 | Critical | 9.8 | 2024-09-11 | A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload e… |
CVE-2024-8232 | High | 7.5 | 2024-09-10 | SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication. |
CVE-2024-44871 | High | 7.2 | 2024-09-10 | An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a crafted f… |
CVE-2024-7770 | High | 8.8 | 2024-09-10 | The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to m… |
CVE-2024-44849 | Critical | 9.8 | 2024-09-09 | Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php. |
CVE-2024-7620 | Medium | 6.6 | 2024-09-07 | The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all… |
CVE-2024-45171 | High | 8.8 | 2024-09-05 | An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for in… |
CVE-2024-8463 | Critical | 9.9 | 2024-09-05 | File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via we… |
CVE-2024-45076 | Critical | 9.9 | 2024-09-04 | IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating sy… |
CVE-2024-42991 | High | 8.1 | 2024-09-03 | MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution. |
CVE-2024-8342 | Medium | 6.3 | 2024-08-30 | A vulnerability, which was classified as critical, has been found in SourceCodester Petshop Management System 1.0. This issue affects some unknown processing o… |
CVE-2024-8341 | Medium | 6.3 | 2024-08-30 | A vulnerability classified as critical was found in SourceCodester Petshop Management System 1.0. This vulnerability affects unknown code of the file /controll… |
CVE-2024-8338 | Medium | 6.3 | 2024-08-30 | A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-8330 | High | 8.8 | 2024-08-30 | 6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell script… |
CVE-2024-8296 | Medium | 6.3 | 2024-08-29 | A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical. This issue affects the function insert of the file /admin/index.php?r=user%2Fcrea… |
CVE-2024-8295 | Medium | 6.3 | 2024-08-29 | A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical. This vulnerability affects the function createBanner of the file /admin/inde… |
CVE-2024-8294 | Medium | 6.3 | 2024-08-29 | A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1. This affects the function update of the file /admin/index.php?r=friendly-… |
CVE-2024-6311 | High | 7.2 | 2024-08-28 | The Funnelforms Free plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'af2_add_font' function in all ver… |
CVE-2024-8170 | Low | 3.5 | 2024-08-26 | A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/ad… |
CVE-2024-8166 | Medium | 4.7 | 2024-08-26 | A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=do… |
CVE-2024-7987 | High | 7.8 | 2024-08-26 | A remote code execution vulnerability exists in the Rockwell Automation ThinManager® ThinServer™ that allows a threat actor to execute arbitrary code with Syst… |
CVE-2024-8164 | Medium | 6.3 | 2024-08-26 | A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controll… |
CVE-2024-42523 | High | 7.2 | 2024-08-23 | publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData |
CVE-2024-7559 | High | 8.8 | 2024-08-23 | The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_fold… |
CVE-2024-8089 | Medium | 6.3 | 2024-08-23 | A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/a… |
CVE-2024-39717 | High | 7.2 | 2024-08-22 | The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-D… |
CVE-2024-42767 | High | 7.2 | 2024-08-22 | Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php. |
CVE-2024-7384 | High | 7.5 | 2024-08-22 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due… |
CVE-2024-42780 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to… |
CVE-2024-42779 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to… |
CVE-2024-42778 | High | 8.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers… |
CVE-2024-42777 | Critical | 9.8 | 2024-08-21 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to exe… |
CVE-2024-42563 | Critical | 9.8 | 2024-08-20 | An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file. |
CVE-2022-1206 | High | 7.2 | 2024-08-20 | The AdRotate Banner Manager – The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension saniti… |
CVE-2024-7944 | Medium | 6.3 | 2024-08-20 | A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been classified as critical. Affected is the function UpdateDocumentsR… |
CVE-2024-7943 | Medium | 6.3 | 2024-08-20 | A vulnerability was found in itsourcecode Laravel Property Management System 1.0 and classified as critical. This issue affects the function upload of the file… |
CVE-2024-43249 | Critical | 9.9 | 2024-08-19 | Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form Pro allows Command Injection.This issue affects Bit Form Pro: from n/a throu… |
CVE-2024-7917 | Medium | 4.7 | 2024-08-18 | A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the f… |
CVE-2024-7910 | Medium | 4.7 | 2024-08-18 | A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2024-7906 | Medium | 6.3 | 2024-08-18 | A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function get_mime_type of the file /admin/dialog/select_image… |
CVE-2024-7905 | Medium | 6.3 | 2024-08-18 | A vulnerability classified as critical has been found in DedeBIZ 6.3.0. This affects the function AdminUpload of the file admin/archives_do.php. The manipulati… |
CVE-2024-7904 | Medium | 6.3 | 2024-08-18 | A vulnerability was found in DedeBIZ 6.3.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/file_manage_c… |
CVE-2024-7903 | Medium | 6.3 | 2024-08-18 | A vulnerability was found in DedeBIZ 6.3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/medi… |
CVE-2023-0714 | High | 8.1 | 2024-08-17 | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and… |
CVE-2024-42676 | High | 8.8 | 2024-08-15 | File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary code via the /nssys/co… |
CVE-2024-39397 | Critical | 9.0 | 2024-08-14 | Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability tha… |
CVE-2024-4389 | High | 8.8 | 2024-08-14 | The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile f… |
CVE-2024-43160 | Critical | 10.0 | 2024-08-13 | Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6. |
CVE-2024-6823 | High | 8.8 | 2024-08-13 | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-uplo… |
CVE-2024-42375 | Medium | 4.3 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by th… |
CVE-2024-41731 | Low | 3.1 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the ap… |
CVE-2024-28166 | Low | 3.7 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by th… |
CVE-2024-7706 | Medium | 4.7 | 2024-08-12 | A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html… |
CVE-2024-7705 | Medium | 4.7 | 2024-08-12 | A vulnerability was found in Fujian mwcms 1.0.0. It has been declared as critical. Affected by this vulnerability is the function uploadeditor of the file /upl… |
CVE-2024-38530 | Critical | 9.8 | 2024-08-12 | The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" function… |
CVE-2024-7694 | High | 7.2 | 2024-08-12 | ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the produc… |
CVE-2024-7399 | High | 8.8 | 2024-08-12 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitr… |
CVE-2024-41577 | Critical | 9.8 | 2024-08-12 | An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG… |
CVE-2024-5226 | Medium | 6.4 | 2024-08-08 | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all versions up to, and… |
CVE-2024-6707 | High | 8.8 | 2024-08-07 | Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. |
CVE-2024-41913 | High | 8.8 | 2024-08-06 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input. |
CVE-2024-7506 | Medium | 6.3 | 2024-08-06 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-7500 | Medium | 6.3 | 2024-08-06 | A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function save_settings o… |
CVE-2024-7484 | High | 7.2 | 2024-08-06 | The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in… |
CVE-2024-6315 | High | 8.8 | 2024-08-06 | The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in al… |
CVE-2024-7495 | Medium | 6.3 | 2024-08-06 | A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/C… |
CVE-2024-6117 | High | 8.8 | 2024-08-05 | A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote aut… |