CWE-434 · Unrestricted Upload of File with Dangerous Type (page 21)
Page 21 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-32954 | Critical | 9.1 | 2024-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in Tribulant Newsletters.This issue affects Newsletters: from n/a through 4.9.5. |
CVE-2024-32836 | Critical | 9.1 | 2024-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay… |
CVE-2024-28890 | Medium | 5.3 | 2024-04-23 | Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may… |
CVE-2024-29368 | Medium | 6.5 | 2024-04-22 | An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via file renaming, poten… |
CVE-2024-29661 | Critical | 9.8 | 2024-04-22 | A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload. |
CVE-2024-23534 | High | 8.8 | 2024-04-19 | An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary command… |
CVE-2024-3948 | Medium | 6.3 | 2024-04-18 | A vulnerability was found in SourceCodester Home Clean Service System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-32161 | Critical | 9.8 | 2024-04-17 | jizhiCMS 2.5 suffers from a File upload vulnerability. |
CVE-2024-32514 | Critical | 9.9 | 2024-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker.This issue affects WP Poll Maker: fr… |
CVE-2024-31680 | High | 8.8 | 2024-04-17 | File Upload vulnerability in Shibang Communications Co., Ltd. IP network intercom broadcasting system v.1.0 allows a local attacker to execute arbitrary code v… |
CVE-2024-32256 | High | 8.1 | 2024-04-16 | Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. When updating a cur… |
CVE-2024-32254 | High | 8.8 | 2024-04-16 | Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin/create-package.php. When creating a ne… |
CVE-2024-3863 | Critical | 9.8 | 2024-04-16 | The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating syst… |
CVE-2020-22539 | High | 7.2 | 2024-04-15 | An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-3804 | Medium | 6.3 | 2024-04-15 | A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue affects some unknown processing of the f… |
CVE-2024-3803 | Medium | 6.3 | 2024-04-15 | A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploa… |
CVE-2024-3778 | High | 7.2 | 2024-04-15 | The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to uploa… |
CVE-2024-3736 | Medium | 4.3 | 2024-04-13 | A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the function upload of the… |
CVE-2024-3705 | High | 8.8 | 2024-04-12 | Unrestricted file upload vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to send a POST request to the endp… |
CVE-2023-51409 | Critical | 10.0 | 2024-04-12 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a… |
CVE-2024-3344 | Medium | 6.4 | 2024-04-11 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upl… |
CVE-2024-31214 | Critical | 9.6 | 2024-04-10 | Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Atta… |
CVE-2024-2221 | Critical | 9.8 | 2024-04-10 | qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specific… |
CVE-2024-24809 | High | 8.5 | 2024-04-10 | Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Sinc… |
CVE-2024-3521 | Medium | 4.7 | 2024-04-09 | A vulnerability was found in Byzoro Smart S80 Management Platform up to 20240317. It has been rated as critical. Affected by this issue is some unknown functio… |
CVE-2024-2334 | Medium | 6.4 | 2024-04-09 | The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and in… |
CVE-2024-2125 | High | 8.8 | 2024-04-09 | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. Th… |
CVE-2024-31454 | Medium | 6.5 | 2024-04-09 | PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for up… |
CVE-2024-31453 | Medium | 6.5 | 2024-04-09 | PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to cr… |
CVE-2024-3444 | Medium | 4.7 | 2024-04-08 | A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_key… |
CVE-2024-3437 | High | 7.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2024-3436 | Medium | 6.3 | 2024-04-08 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2024-31345 | Critical | 9.1 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Sukhchain Singh Auto Poster.This issue affects Auto Poster: from n/a through 1.2. |
CVE-2024-31292 | High | 7.2 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in Moove Agency Import XML and RSS Feeds.This issue affects Import XML and RSS Feeds: from n/a th… |
CVE-2024-31286 | Critical | 9.9 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from… |
CVE-2024-31280 | Critical | 9.9 | 2024-04-07 | Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1… |
CVE-2024-3369 | Medium | 6.3 | 2024-04-06 | A vulnerability, which was classified as critical, has been found in code-projects Car Rental 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2024-31210 | High | 7.6 | 2024-04-04 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administra… |
CVE-2024-29387 | High | 8.8 | 2024-04-04 | projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/print.php. |
CVE-2024-28520 | Medium | 6.5 | 2024-04-04 | File Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent management platform version S210, allows an attacker to obtain se… |
CVE-2024-3022 | High | 7.2 | 2024-04-04 | The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_process_upload' func… |
CVE-2024-27951 | Critical | 9.1 | 2024-04-03 | Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This… |
CVE-2024-31012 | Critical | 9.8 | 2024-04-03 | An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the uploa… |
CVE-2024-29514 | High | 8.8 | 2024-04-02 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2024-3129 | Medium | 6.3 | 2024-04-01 | A vulnerability was found in SourceCodester Image Accordion Gallery App 1.0. It has been classified as critical. This affects an unknown part of the file /endp… |
CVE-2024-30533 | High | 7.5 | 2024-03-31 | Unrestricted Upload of File with Dangerous Type vulnerability in Techeshta Layouts for Elementor.This issue affects Layouts for Elementor: from n/a before 1.8. |
CVE-2024-31115 | Critical | 10.0 | 2024-03-31 | Unrestricted Upload of File with Dangerous Type vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress.This issue affects Chauffeur Taxi Boo… |
CVE-2024-31114 | Critical | 9.1 | 2024-03-31 | Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5. |
CVE-2024-3117 | Medium | 4.7 | 2024-03-31 | A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Action\Admin\ChannelAc… |
CVE-2023-46808 | Critical | 9.9 | 2024-03-31 | An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation ma… |
CVE-2024-30510 | Critical | 10.0 | 2024-03-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a th… |
CVE-2024-30500 | Critical | 9.9 | 2024-03-29 | Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dy… |
CVE-2024-28713 | Critical | 9.8 | 2024-03-28 | An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature. |
CVE-2024-2890 | Critical | 9.1 | 2024-03-28 | Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through… |
CVE-2024-29100 | Critical | 9.1 | 2024-03-28 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a… |
CVE-2024-29891 | High | 8.7 | 2024-03-27 | ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an… |
CVE-2023-49815 | Critical | 10.0 | 2024-03-27 | Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0.3. |
CVE-2024-1532 | Medium | 6.8 | 2024-03-27 | A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could enforce diagnost… |
CVE-2024-1531 | High | 8.2 | 2024-03-27 | A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could print random mem… |
CVE-2024-2930 | High | 7.3 | 2024-03-27 | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2023-48777 | Critical | 9.9 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3… |
CVE-2023-48275 | High | 8.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Trustindex.Io Widgets for Google Reviews.This issue affects Widgets for Google Reviews: from n… |
CVE-2023-47873 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a t… |
CVE-2023-47846 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2. |
CVE-2023-47842 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a through 1.7.0. |
CVE-2023-39307 | High | 8.5 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. |
CVE-2023-38388 | Critical | 9.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5. |
CVE-2023-29386 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0. |
CVE-2023-6091 | High | 7.2 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in mndpsingh287 Theme Editor.This issue affects Theme Editor: from n/a through 2.7.1. |
CVE-2023-27440 | High | 7.2 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in OnTheGoSystems Types.This issue affects Types: from n/a through 3.4.17. |
CVE-2023-23656 | Critical | 10.0 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from… |
CVE-2024-30231 | Critical | 9.1 | 2024-03-26 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-29515 | High | 8.8 | 2024-03-25 | File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php… |
CVE-2024-28105 | High | 7.2 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulner… |
CVE-2020-36825 | Medium | 6.3 | 2024-03-24 | ** UNSUPPORTED WHEN ASSIGNED ** ** DISPUTED ** A vulnerability has been found in cyberaz0r WebRAT up to 20191222 and classified as critical. This vulnerability… |
CVE-2024-2849 | Medium | 6.3 | 2024-03-23 | A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the ar… |
CVE-2024-29272 | Medium | 6.5 | 2024-03-22 | Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive inf… |
CVE-2024-28441 | Critical | 9.8 | 2024-03-22 | File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of… |
CVE-2024-27964 | High | 8.8 | 2024-03-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.9. |
CVE-2024-2754 | Medium | 4.7 | 2024-03-21 | A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_… |
CVE-2024-29859 | Critical | 9.8 | 2024-03-21 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. |
CVE-2024-27923 | High | 8.8 | 2024-03-21 | Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission… |
CVE-2023-51444 | High | 7.2 | 2024-03-20 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file upload vulnerability exists… |
CVE-2024-2690 | Medium | 6.3 | 2024-03-20 | A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file /… |
CVE-2024-1205 | High | 8.8 | 2024-03-20 | The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary… |
CVE-2024-29135 | Critical | 9.9 | 2024-03-19 | Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15. |
CVE-2024-2636 | Critical | 9.0 | 2024-03-19 | An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/esp… |
CVE-2024-2604 | Medium | 6.3 | 2024-03-18 | A vulnerability was found in SourceCodester File Manager App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoi… |
CVE-2024-2599 | Critical | 9.9 | 2024-03-18 | File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through we… |
CVE-2023-39933 | Medium | 4.3 | 2024-03-18 | Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerab… |
CVE-2024-27957 | Critical | 10.0 | 2024-03-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1. |
CVE-2024-2565 | Medium | 6.3 | 2024-03-17 | A vulnerability was found in PandaXGO PandaX up to 20240310. It has been classified as critical. Affected is an unknown function of the file /apps/system/route… |
CVE-2024-2561 | Medium | 6.3 | 2024-03-17 | A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0. Affected by this issue is the function sendCompanyLogo of the file /controll… |
CVE-2024-2531 | Medium | 6.3 | 2024-03-16 | A vulnerability classified as critical has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected is an unknown function of the fi… |
CVE-2024-2529 | Medium | 6.3 | 2024-03-16 | A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been declared as critical. This vulnerability affects unknown… |
CVE-2024-26503 | Critical | 9.1 | 2024-03-14 | Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafte… |
CVE-2023-42286 | Critical | 9.8 | 2024-03-14 | There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a ca… |
CVE-2024-28425 | High | 7.5 | 2024-03-14 | greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability all… |
CVE-2024-28423 | Critical | 9.8 | 2024-03-14 | Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulnerability allows attac… |
CVE-2024-28418 | Medium | 6.5 | 2024-03-14 | Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php |