CWE-434 · Unrestricted Upload of File with Dangerous Type (page 20)
Page 20 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35746 | Critical | 10.0 | 2024-06-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover: f… |
CVE-2023-45188 | Medium | 6.5 | 2024-06-09 | IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to upload arbitrary files, caused by the improper validation of… |
CVE-2024-5745 | High | 7.3 | 2024-06-07 | A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /a… |
CVE-2024-5734 | Medium | 6.3 | 2024-06-07 | A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster… |
CVE-2024-36774 | High | 7.2 | 2024-06-06 | An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2024-5278 | Medium | 6.1 | 2024-06-06 | gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` en… |
CVE-2024-37273 | Critical | 9.8 | 2024-06-04 | An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2024-36858 | Critical | 9.8 | 2024-06-04 | An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-33930 | Critical | 9.1 | 2024-06-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows C… |
CVE-2024-0757 | Medium | 5.4 | 2024-06-04 | The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on… |
CVE-2024-29974 | Critical | 9.8 | 2024-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versions before V5.21(AAZ… |
CVE-2024-29848 | High | 7.2 | 2024-05-31 | An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary comma… |
CVE-2024-22060 | Medium | 4.9 | 2024-05-31 | An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary f… |
CVE-2024-5518 | Medium | 6.3 | 2024-05-30 | A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file change_profile_pict… |
CVE-2024-3412 | Critical | 9.1 | 2024-05-29 | The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat… |
CVE-2024-22641 | High | 7.5 | 2024-05-28 | TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file. |
CVE-2024-35510 | Critical | 9.8 | 2024-05-28 | An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-46694 | High | 8.1 | 2024-05-28 | Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the app… |
CVE-2022-45171 | High | 8.8 | 2024-05-28 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site… |
CVE-2024-5377 | High | 7.3 | 2024-05-26 | A vulnerability was found in SourceCodester Vehicle Management System 1.0. It has been classified as critical. This affects an unknown part of the file /newveh… |
CVE-2024-35593 | Medium | 5.5 | 2024-05-24 | An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uploading a crafted PDF… |
CVE-2024-1332 | Medium | 6.4 | 2024-05-24 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and inc… |
CVE-2024-5247 | High | 8.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2024-35570 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via… |
CVE-2024-35375 | Critical | 9.8 | 2024-05-23 | There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS |
CVE-2024-35080 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file. |
CVE-2024-35079 | Critical | 9.8 | 2024-05-23 | An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file. |
CVE-2024-5084 | Critical | 9.8 | 2024-05-23 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_a… |
CVE-2024-5145 | Medium | 6.3 | 2024-05-20 | A vulnerability was found in SourceCodester Vehicle Management System up to 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2024-5050 | Medium | 6.3 | 2024-05-17 | A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_s… |
CVE-2024-5049 | Medium | 6.3 | 2024-05-17 | A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2024-5047 | High | 7.3 | 2024-05-17 | A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Affected is an unknown function of the file /student/con… |
CVE-2024-34982 | Critical | 9.8 | 2024-05-17 | An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a craf… |
CVE-2024-5043 | Medium | 4.7 | 2024-05-17 | A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. Th… |
CVE-2024-32809 | Critical | 10.0 | 2024-05-17 | Unrestricted Upload of File with Dangerous Type vulnerability in JumpDEMAND Inc. ActiveDEMAND allows Using Malicious Files.This issue affects ActiveDEMAND: fro… |
CVE-2024-33556 | High | 8.2 | 2024-05-17 | Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8. |
CVE-2024-31351 | Critical | 10.0 | 2024-05-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content… |
CVE-2023-25444 | Critical | 9.1 | 2024-05-17 | Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This… |
CVE-2024-4966 | High | 7.3 | 2024-05-16 | A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.ph… |
CVE-2024-4964 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This vulnerability affects unknow… |
CVE-2024-4963 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part o… |
CVE-2024-4962 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000-40 V31R02B1413C. Affected by this issue is… |
CVE-2024-4961 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-7000-40 V31R02B1413C. Affected by this vulnerability is an unkno… |
CVE-2024-4960 | Medium | 6.3 | 2024-05-16 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000-40 V31R02B1413C. Affected is an unknown function of th… |
CVE-2024-4946 | Medium | 6.3 | 2024-05-16 | A vulnerability was found in SourceCodester Online Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an un… |
CVE-2024-4945 | Medium | 4.3 | 2024-05-16 | A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as problematic. Affected is an unknown function of the f… |
CVE-2024-4927 | High | 7.3 | 2024-05-16 | A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-4923 | Medium | 6.3 | 2024-05-16 | A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct… |
CVE-2024-4921 | Medium | 6.3 | 2024-05-16 | A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of t… |
CVE-2024-4920 | High | 7.3 | 2024-05-16 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2024-4904 | Medium | 6.3 | 2024-05-15 | A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2024-34913 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34909 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-34906 | Medium | 5.4 | 2024-05-15 | An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2024-3488 | Medium | 5.6 | 2024-05-15 | File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file withou… |
CVE-2024-3483 | High | 7.8 | 2024-05-15 | Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues… |
CVE-2024-32002 | Critical | 9.0 | 2024-05-14 | Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in… |
CVE-2024-33006 | Critical | 9.6 | 2024-05-14 | An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system. |
CVE-2024-27945 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a privileged user to upl… |
CVE-2024-27944 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload firmware files to the r… |
CVE-2024-27943 | High | 7.2 | 2024-05-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload generic files to the ro… |
CVE-2024-4825 | Critical | 9.8 | 2024-05-14 | A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An att… |
CVE-2024-4820 | Medium | 6.3 | 2024-05-14 | A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2024-4809 | Medium | 6.3 | 2024-05-14 | A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unkn… |
CVE-2024-4681 | Medium | 4.7 | 2024-05-14 | A vulnerability, which was classified as critical, was found in Campcodes Legal Case Management System 1.0. Affected is an unknown function of the file /admin/… |
CVE-2024-4560 | Critical | 9.8 | 2024-05-14 | The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbot_chatgpt_upl… |
CVE-2024-4397 | High | 8.8 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materi… |
CVE-2024-34555 | Critical | 10.0 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in URBAN BASE Z-Downloads.This issue affects Z-Downloads: from n/a through 1.11.3. |
CVE-2024-34440 | Critical | 9.1 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a… |
CVE-2024-34416 | Critical | 9.1 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Pk Favicon Manager.This issue affects Pk Favicon Manager: from n/a through 2.1. |
CVE-2024-34411 | Critical | 9.9 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Thomas Scholl canvasio3D Light.This issue affects canvasio3D Light: from n/a through 2.5.0. |
CVE-2024-32700 | Critical | 10.0 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in Kognetiks Kognetiks Chatbot for WordPress.This issue affects Kognetiks Chatbot for WordPress… |
CVE-2024-31377 | Critical | 10.0 | 2024-05-14 | Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from… |
CVE-2023-50717 | Medium | 5.7 | 2024-05-14 | NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with ma… |
CVE-2023-47711 | Low | 2.7 | 2024-05-14 | IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow an authenticated user to upload files that would cause a denial of service. IBM X-Force ID: 2715… |
CVE-2021-35002 | High | 8.8 | 2024-05-07 | BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2024-33120 | Critical | 9.8 | 2024-05-07 | Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vulnerability allows… |
CVE-2024-4345 | Critical | 9.8 | 2024-05-07 | The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process' function… |
CVE-2024-33752 | Medium | 6.3 | 2024-05-06 | An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit… |
CVE-2024-4500 | Medium | 6.3 | 2024-05-05 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-33786 | Critical | 9.8 | 2024-05-03 | An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code via uploading a craft… |
CVE-2023-51590 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower Pro UpLoadAction Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2023-39463 | High | 7.2 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Trusted Certification Unrestricted Upload of File Remote Code Execution Vulnerability. This vulnerability allows remote… |
CVE-2023-39462 | Medium | 6.5 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Workspace Unrestricted Upload Vulnerability. This vulnerability allows remote attackers to upload arbitrary files on aff… |
CVE-2023-38098 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2023-38095 | High | 8.8 | 2024-05-03 | NETGEAR ProSAFE Network Management System MFileUploadController Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote… |
CVE-2024-4033 | High | 8.8 | 2024-05-02 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the aiovg_create_attachment_fr… |
CVE-2024-2667 | Critical | 9.8 | 2024-05-02 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /… |
CVE-2024-1567 | High | 8.2 | 2024-05-02 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'file_validity'… |
CVE-2024-4349 | High | 7.3 | 2024-04-30 | A vulnerability has been found in SourceCodester Pisay Online E-Learning System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-28269 | High | 7.2 | 2024-04-30 | ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability to upload of malic… |
CVE-2024-33438 | High | 8.0 | 2024-04-29 | File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file. |
CVE-2024-4306 | Critical | 9.9 | 2024-04-29 | Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload malicious PHP files v… |
CVE-2024-32880 | Critical | 9.1 | 2024-04-26 | pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the spe… |
CVE-2024-3962 | Critical | 9.8 | 2024-04-26 | The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload… |
CVE-2024-0916 | Critical | 10.0 | 2024-04-25 | Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3. |
CVE-2024-31610 | Medium | 6.3 | 2024-04-25 | File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitra… |
CVE-2024-31615 | Critical | 9.8 | 2024-04-25 | ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. |
CVE-2024-3508 | Medium | 4.3 | 2024-04-25 | A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fiel… |
CVE-2023-31090 | Critical | 9.9 | 2024-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows U… |