CWE-434 · Unrestricted Upload of File with Dangerous Type (page 22)
Page 22 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41505 | Critical | 9.8 | 2024-03-13 | An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary co… |
CVE-2024-0800 | High | 8.8 | 2024-03-13 | A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servle… |
CVE-2024-1311 | High | 8.8 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all ve… |
CVE-2024-2406 | Medium | 5.4 | 2024-03-12 | A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Uplo… |
CVE-2023-30968 | Medium | 6.8 | 2024-03-12 | One of Gotham Gaia services was found to be vulnerable to a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker to bypass CSP a… |
CVE-2024-1527 | Critical | 9.8 | 2024-03-12 | Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security mea… |
CVE-2024-2394 | Medium | 4.7 | 2024-03-12 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2024-25994 | Medium | 5.3 | 2024-03-12 | An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only. |
CVE-2024-2268 | Medium | 4.7 | 2024-03-07 | A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0. It has been classified as critical. Affected is an unknown function of the file /product… |
CVE-2024-1986 | High | 8.8 | 2024-03-07 | The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product()… |
CVE-2024-27733 | High | 7.7 | 2024-03-07 | File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestati… |
CVE-2023-45599 | Medium | 5.5 | 2024-03-05 | A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote… |
CVE-2023-45595 | Medium | 5.9 | 2024-03-05 | A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote auth… |
CVE-2024-2148 | Medium | 6.3 | 2024-03-03 | A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/U… |
CVE-2024-27747 | Critical | 9.8 | 2024-03-01 | File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image paramet… |
CVE-2024-2059 | Medium | 4.7 | 2024-03-01 | A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2024-2058 | Medium | 4.7 | 2024-03-01 | A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown… |
CVE-2024-0864 | Critical | 9.8 | 2024-02-29 | Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation… |
CVE-2023-6090 | Critical | 9.1 | 2024-02-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Mollie Mollie Payments for WooCommerce.This issue affects Mollie Payments for WooCommerce: fro… |
CVE-2024-1468 | High | 8.8 | 2024-02-29 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2024-25832 | High | 8.8 | 2024-02-29 | F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by mani… |
CVE-2024-24146 | Medium | 6.5 | 2024-02-29 | A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file. |
CVE-2024-23946 | Medium | 5.3 | 2024-02-29 | Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue. |
CVE-2023-25921 | High | 8.5 | 2024-02-29 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be aut… |
CVE-2024-25869 | High | 8.8 | 2024-02-28 | An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload… |
CVE-2023-25922 | Medium | 4.3 | 2024-02-28 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be auto… |
CVE-2024-1932 | Medium | 4.8 | 2024-02-28 | Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout |
CVE-2024-25846 | Critical | 9.1 | 2024-02-27 | In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extension… |
CVE-2024-1925 | Medium | 5.0 | 2024-02-27 | A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Up… |
CVE-2024-1921 | Medium | 4.7 | 2024-02-27 | A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Set… |
CVE-2024-1918 | Medium | 4.7 | 2024-02-27 | A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2023-41506 | Critical | 9.8 | 2024-02-27 | An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbi… |
CVE-2024-25925 | Critical | 10.0 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooComme… |
CVE-2024-25913 | Critical | 10.0 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2. |
CVE-2024-25909 | Critical | 9.9 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2. |
CVE-2024-25410 | Medium | 6.5 | 2024-02-26 | flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php. |
CVE-2024-24714 | High | 7.2 | 2024-02-26 | Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4. |
CVE-2024-1875 | Medium | 6.3 | 2024-02-26 | A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2024-1819 | Medium | 4.7 | 2024-02-23 | A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the component Add… |
CVE-2024-1818 | Medium | 4.7 | 2024-02-23 | A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2024-25802 | Critical | 9.8 | 2024-02-22 | SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content. |
CVE-2024-22393 | Critical | 9.1 | 2024-02-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploadin… |
CVE-2024-27283 | High | 7.2 | 2024-02-22 | A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious files to arbitrary… |
CVE-2024-25801 | Medium | 6.1 | 2024-02-22 | SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a fi… |
CVE-2023-52154 | High | 7.2 | 2024-02-21 | File Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files. |
CVE-2024-25274 | Critical | 9.8 | 2024-02-20 | An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a cra… |
CVE-2024-22824 | Critical | 9.8 | 2024-02-20 | An issue in Timo v.2.0.3 allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java component. |
CVE-2024-1644 | Critical | 9.9 | 2024-02-20 | Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI. |
CVE-2024-25636 | High | 7.1 | 2024-02-19 | Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when fetching remote Activity Streams objec… |
CVE-2024-25623 | High | 8.5 | 2024-02-19 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and 3.5.19, when fetching remote statuses… |
CVE-2022-42443 | Low | 2.2 | 2024-02-17 | An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of file… |
CVE-2024-25627 | Low | 3.5 | 2024-02-16 | Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaS… |
CVE-2024-22426 | High | 7.2 | 2024-02-16 | Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially expl… |
CVE-2024-25414 | Critical | 9.8 | 2024-02-16 | An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file. |
CVE-2024-23811 | High | 8.8 | 2024-02-13 | A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This coul… |
CVE-2024-23762 | High | 7.8 | 2024-02-12 | Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of crafted PHP file. |
CVE-2024-23759 | Critical | 9.8 | 2024-02-12 | Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBoo… |
CVE-2023-50386 | High | 8.8 | 2024-02-09 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphe… |
CVE-2024-25674 | Critical | 9.8 | 2024-02-09 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. |
CVE-2024-24393 | Critical | 9.8 | 2024-02-08 | File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request. |
CVE-2023-40265 | High | 8.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file up… |
CVE-2023-25365 | High | 7.8 | 2024-02-08 | Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 |
CVE-2024-24202 | Critical | 9.8 | 2024-02-08 | An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to e… |
CVE-2024-24350 | High | 8.8 | 2024-02-08 | File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering compo… |
CVE-2024-24026 | Critical | 9.8 | 2024-02-08 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An a… |
CVE-2024-24025 | Critical | 9.8 | 2024-02-08 | An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). An attacker can pas… |
CVE-2024-24024 | Critical | 9.8 | 2024-02-08 | An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDownload(). An attacker… |
CVE-2024-1268 | Medium | 6.3 | 2024-02-07 | A vulnerability, which was classified as critical, was found in CodeAstro Restaurant POS System 1.0. This affects an unknown part of the file update_product.ph… |
CVE-2024-1264 | Medium | 6.3 | 2024-02-07 | A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical. Affected by this vulnerability is the function actionUpdate of the fi… |
CVE-2024-1263 | Medium | 6.3 | 2024-02-06 | A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers… |
CVE-2024-1262 | Medium | 6.3 | 2024-02-06 | A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02. This issue affects the function actionUpdate of the file /api… |
CVE-2024-1261 | Medium | 6.3 | 2024-02-06 | A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controlle… |
CVE-2024-1260 | Medium | 6.3 | 2024-02-06 | A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/… |
CVE-2024-22515 | High | 8.8 | 2024-02-06 | Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio component. |
CVE-2024-1259 | Medium | 6.3 | 2024-02-06 | A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/… |
CVE-2024-1253 | Medium | 4.7 | 2024-02-06 | A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknow… |
CVE-2024-24000 | Critical | 9.8 | 2024-02-06 | jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter… |
CVE-2024-0699 | Medium | 6.6 | 2024-02-05 | The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati… |
CVE-2023-6925 | High | 7.2 | 2024-02-05 | The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'im… |
CVE-2023-6846 | High | 8.8 | 2024-02-05 | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_s… |
CVE-2023-6635 | High | 7.2 | 2024-02-05 | The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up… |
CVE-2024-22567 | High | 8.8 | 2024-02-05 | File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do. |
CVE-2021-4436 | Critical | 9.8 | 2024-02-05 | The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action… |
CVE-2023-6675 | Critical | 9.8 | 2024-02-02 | Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server. Th… |
CVE-2024-1116 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller… |
CVE-2024-1113 | Medium | 6.3 | 2024-01-31 | A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/contro… |
CVE-2024-1069 | High | 7.2 | 2024-01-31 | The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versio… |
CVE-2023-31505 | High | 7.2 | 2024-01-31 | An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information… |
CVE-2024-1036 | High | 7.3 | 2024-01-30 | A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controlle… |
CVE-2024-1035 | High | 7.3 | 2024-01-30 | A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function uploadIcon of the file /application/in… |
CVE-2024-1034 | High | 7.3 | 2024-01-30 | A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/control… |
CVE-2024-1027 | Medium | 6.3 | 2024-01-30 | A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Po… |
CVE-2024-1008 | Medium | 4.7 | 2024-01-29 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2024-0939 | Medium | 6.3 | 2024-01-26 | A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of t… |
CVE-2024-0933 | Medium | 6.3 | 2024-01-26 | A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.ph… |
CVE-2024-22550 | Medium | 6.1 | 2024-01-26 | An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a cra… |
CVE-2024-23630 | Critical | 9.0 | 2024-01-26 | An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execution on the device… |
CVE-2024-24399 | High | 7.2 | 2024-01-25 | An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/lang… |
CVE-2024-22152 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Product Import Export for WooCommerce.This issue affects Product Import Export for W… |
CVE-2024-22135 | High | 8.0 | 2024-01-24 | Unrestricted Upload of File with Dangerous Type vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order… |