CWE-434 · Unrestricted Upload of File with Dangerous Type (page 19)
Page 19 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7450 | Medium | 6.3 | 2024-08-04 | A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functio… |
CVE-2024-7257 | Critical | 9.8 | 2024-08-03 | The YayExtra – WooCommerce Extra Product Options plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle… |
CVE-2024-7342 | Low | 3.5 | 2024-08-01 | A vulnerability was found in Baidu UEditor 1.4.3.3. It has been classified as problematic. This affects an unknown part of the file /ueditor/php/controller.php… |
CVE-2024-34021 | Medium | 6.8 | 2024-08-01 | Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected p… |
CVE-2024-7329 | Medium | 6.3 | 2024-07-31 | A vulnerability, which was classified as critical, was found in YouDianCMS 7. Affected is an unknown function of the file /Public/ckeditor/plugins/multiimage/d… |
CVE-2024-40645 | High | 8.8 | 2024-07-31 | FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary… |
CVE-2024-7277 | Medium | 4.7 | 2024-07-31 | A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2024-38529 | Critical | 9.0 | 2024-07-29 | Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execut… |
CVE-2024-7192 | Medium | 6.3 | 2024-07-29 | A vulnerability, which was classified as critical, was found in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/stu… |
CVE-2024-7189 | Medium | 6.3 | 2024-07-29 | A vulnerability classified as critical has been found in itsourcecode Online Food Ordering System 1.0. Affected is an unknown function of the file editproduct… |
CVE-2024-6366 | Critical | 9.1 | 2024-07-29 | The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async… |
CVE-2024-42054 | Medium | 5.4 | 2024-07-28 | Cervantes through 0.5-alpha accepts insecure file uploads. |
CVE-2024-6431 | High | 8.8 | 2024-07-27 | The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the… |
CVE-2024-40318 | High | 7.2 | 2024-07-25 | An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-6756 | High | 8.8 | 2024-07-24 | The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path'… |
CVE-2024-6828 | High | 7.2 | 2024-07-23 | The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Col… |
CVE-2024-6958 | Medium | 6.3 | 2024-07-21 | A vulnerability classified as critical was found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /st_upda… |
CVE-2024-6948 | Medium | 6.3 | 2024-07-21 | A vulnerability classified as critical has been found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected is an unknown function of the fil… |
CVE-2024-6945 | Medium | 6.3 | 2024-07-21 | A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been classified as critical. This affects an unknown part of the file app/Core/Http/Controllers/Pr… |
CVE-2024-40400 | High | 8.8 | 2024-07-19 | An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file. |
CVE-2024-3242 | High | 8.8 | 2024-07-18 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent func… |
CVE-2024-20296 | Medium | 4.7 | 2024-07-17 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary… |
CVE-2024-27311 | Medium | 5.5 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the… |
CVE-2024-31411 | High | 8.8 | 2024-07-17 | Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remot… |
CVE-2024-6220 | Critical | 9.8 | 2024-07-17 | The 简数采集器 (Keydatas) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the keydatas_downloadImages function i… |
CVE-2024-6801 | Medium | 6.3 | 2024-07-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects some unknown proce… |
CVE-2024-6595 | Low | 3.0 | 2024-07-17 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1… |
CVE-2024-40394 | Critical | 9.8 | 2024-07-16 | Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php. |
CVE-2024-40425 | Critical | 9.8 | 2024-07-16 | File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary co… |
CVE-2024-40555 | Medium | 5.3 | 2024-07-15 | Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2024-40553 | Medium | 4.9 | 2024-07-15 | Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage. |
CVE-2024-5630 | High | 8.8 | 2024-07-15 | The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may… |
CVE-2024-6730 | Medium | 6.3 | 2024-07-14 | A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-5450 | Critical | 9.1 | 2024-07-13 | The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files |
CVE-2024-5080 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the ser… |
CVE-2024-40551 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via u… |
CVE-2024-40550 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary… |
CVE-2024-40549 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via… |
CVE-2024-40548 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploa… |
CVE-2024-40546 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via upload… |
CVE-2024-40545 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via up… |
CVE-2024-38736 | Critical | 9.1 | 2024-07-12 | Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic… |
CVE-2024-38734 | Critical | 9.1 | 2024-07-12 | Unrestricted Upload of File with Dangerous Type vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Code Injection.This issue… |
CVE-2024-3112 | Medium | 4.8 | 2024-07-12 | The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to… |
CVE-2024-5911 | Medium | 4.9 | 2024-07-10 | An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interfa… |
CVE-2024-6647 | Medium | 4.7 | 2024-07-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/set… |
CVE-2023-7061 | High | 8.8 | 2024-07-10 | The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it po… |
CVE-2024-39865 | High | 8.8 | 2024-07-09 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup… |
CVE-2024-37424 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspa… |
CVE-2024-37420 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affect… |
CVE-2024-37418 | Critical | 9.9 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4… |
CVE-2024-6314 | Critical | 9.8 | 2024-07-09 | The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process_image_upload' functio… |
CVE-2024-6313 | Critical | 9.8 | 2024-07-09 | The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function i… |
CVE-2024-6161 | High | 8.8 | 2024-07-09 | The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cache_image' function i… |
CVE-2024-6123 | High | 7.2 | 2024-07-09 | The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up t… |
CVE-2024-37555 | Critical | 9.1 | 2024-07-09 | Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affe… |
CVE-2024-5441 | High | 8.8 | 2024-07-09 | The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function… |
CVE-2024-34692 | Low | 3.3 | 2024-07-09 | Due to missing verification of file type or content, SAP Enable Now allows an authenticated attacker to upload arbitrary files. These files include executables… |
CVE-2024-27903 | Critical | 9.8 | 2024-07-08 | OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can… |
CVE-2024-6319 | High | 8.8 | 2024-07-04 | The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to… |
CVE-2024-6318 | High | 8.8 | 2024-07-04 | The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all version… |
CVE-2024-6439 | Medium | 6.3 | 2024-07-02 | A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing… |
CVE-2024-37762 | Critical | 9.9 | 2024-07-01 | MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution. |
CVE-2024-36987 | Medium | 4.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, an authenticated, low-privileged user who d… |
CVE-2024-3123 | High | 7.2 | 2024-07-01 | CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can… |
CVE-2024-6127 | Critical | 9.8 | 2024-06-27 | BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit… |
CVE-2024-6373 | High | 7.3 | 2024-06-27 | A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vulnerability affects unknown code of the… |
CVE-2024-6054 | High | 8.8 | 2024-06-27 | The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post_attachment_from_ur… |
CVE-2024-35527 | Critical | 9.8 | 2024-06-25 | An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrar… |
CVE-2024-5008 | High | 8.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Ar… |
CVE-2024-4197 | Critical | 9.9 | 2024-06-25 | An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected… |
CVE-2024-37228 | Critical | 10.0 | 2024-06-24 | Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <… |
CVE-2024-24551 | High | 8.8 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability ar… |
CVE-2024-24550 | High | 8.1 | 2024-06-24 | A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which… |
CVE-2024-6280 | Medium | 6.3 | 2024-06-24 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /adm… |
CVE-2024-35767 | Critical | 9.1 | 2024-06-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This issue affects Squeeze: from n/a through 1… |
CVE-2023-45197 | Critical | 9.8 | 2024-06-21 | The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attack… |
CVE-2024-28147 | High | 7.4 | 2024-06-20 | An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes mali… |
CVE-2024-34990 | Critical | 10.0 | 2024-06-19 | In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files… |
CVE-2024-33836 | Critical | 9.8 | 2024-06-19 | In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X… |
CVE-2024-22263 | High | 8.8 | 2024-06-19 | Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to rece… |
CVE-2024-6132 | High | 8.8 | 2024-06-19 | The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_option… |
CVE-2024-5853 | Critical | 9.9 | 2024-06-19 | The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirv_upload… |
CVE-2024-3229 | Critical | 9.8 | 2024-06-19 | The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistan… |
CVE-2024-2381 | High | 8.8 | 2024-06-19 | The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save… |
CVE-2024-6116 | High | 7.3 | 2024-06-18 | A vulnerability, which was classified as critical, has been found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this issue is some un… |
CVE-2024-6115 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical was found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown funct… |
CVE-2024-6114 | High | 7.3 | 2024-06-18 | A vulnerability classified as critical has been found in itsourcecode Monbela Tourist Inn Online Reservation System up to 1.0. Affected is an unknown function… |
CVE-2024-6110 | High | 7.3 | 2024-06-18 | A vulnerability was found in itsourcecode Magbanua Beach Resort Online Reservation System up to 1.0. It has been rated as critical. Affected by this issue is s… |
CVE-2024-6084 | High | 7.3 | 2024-06-18 | A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability… |
CVE-2024-6083 | Medium | 6.3 | 2024-06-18 | A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/upload-mp3.php of t… |
CVE-2024-34833 | Critical | 9.8 | 2024-06-17 | Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settings" page. An unauthenticated attacker c… |
CVE-2024-3912 | Critical | 9.8 | 2024-06-14 | Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute ar… |
CVE-2024-31161 | High | 7.2 | 2024-06-14 | The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerabi… |
CVE-2024-31777 | Critical | 9.8 | 2024-06-13 | File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint. |
CVE-2024-36396 | High | 8.8 | 2024-06-13 | Verint - CWE-434: Unrestricted Upload of File with Dangerous Type |
CVE-2024-34110 | High | 7.2 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that c… |
CVE-2024-1659 | Critical | 9.8 | 2024-06-12 | Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server (including a PHP code file) without an authentication… |
CVE-2024-34683 | Medium | 6.5 | 2024-06-11 | An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, mod… |
CVE-2024-36415 | Critical | 9.1 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file ve… |