CWE-434 · Unrestricted Upload of File with Dangerous Type (page 24)
Page 24 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4122 | Critical | 9.9 | 2023-12-07 | Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated a… |
CVE-2023-6576 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile… |
CVE-2023-6574 | Medium | 6.3 | 2023-12-07 | A vulnerability was found in Byzoro Smart S20 up to 20231120 and classified as critical. Affected by this issue is some unknown functionality of the file /sysm… |
CVE-2023-39539 | High | 7.5 | 2023-12-06 | AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful… |
CVE-2023-39538 | High | 7.5 | 2023-12-06 | AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful… |
CVE-2023-48930 | Critical | 9.8 | 2023-12-06 | xinhu xinhuoa 2.2.1 contains a File upload vulnerability. |
CVE-2023-40460 | High | 7.1 | 2023-12-04 | The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authentica… |
CVE-2023-5953 | High | 8.8 | 2023-12-04 | The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action… |
CVE-2023-48966 | High | 8.8 | 2023-12-04 | An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Z… |
CVE-2023-48965 | High | 8.8 | 2023-12-04 | An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP fi… |
CVE-2023-5637 | High | 7.5 | 2023-12-01 | Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable. This issue af… |
CVE-2023-5636 | Critical | 9.8 | 2023-12-01 | Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection. This issue affects Education Portal: be… |
CVE-2023-6449 | Medium | 6.6 | 2023-12-01 | The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' function and insuffi… |
CVE-2023-5966 | Medium | 4.7 | 2023-11-30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which coul… |
CVE-2023-5965 | Medium | 4.7 | 2023-11-30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbi… |
CVE-2023-49052 | High | 8.8 | 2023-11-30 | File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the crea… |
CVE-2023-4226 | High | 8.8 | 2023-11-28 | Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code ex… |
CVE-2023-4225 | High | 8.8 | 2023-11-28 | Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote cod… |
CVE-2023-4224 | High | 8.8 | 2023-11-28 | Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code… |
CVE-2023-4223 | High | 8.8 | 2023-11-28 | Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote cod… |
CVE-2023-4220 | High | 8.1 | 2023-11-28 | Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthent… |
CVE-2023-6219 | High | 7.2 | 2023-11-28 | The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_process_upload' function… |
CVE-2023-29770 | High | 8.8 | 2023-11-28 | In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering. |
CVE-2023-5604 | Critical | 9.8 | 2023-11-27 | The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration tha… |
CVE-2023-41998 | Critical | 9.8 | 2023-11-27 | Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacke… |
CVE-2023-6308 | Medium | 6.3 | 2023-11-27 | A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management System 2016/2017. Affected by this issue i… |
CVE-2023-6274 | Medium | 6.3 | 2023-11-24 | A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2023-41812 | Medium | 5.7 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41788 | High | 7.6 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-5822 | High | 8.1 | 2023-11-22 | The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation i… |
CVE-2023-6187 | High | 7.5 | 2023-11-18 | The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_sess… |
CVE-2023-39548 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-48031 | Critical | 9.8 | 2023-11-17 | OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions an… |
CVE-2023-6133 | Medium | 6.6 | 2023-11-15 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in… |
CVE-2023-48217 | High | 8.8 | 2023-11-14 | Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like imag… |
CVE-2023-6127 | Medium | 5.4 | 2023-11-14 | Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-47621 | High | 8.8 | 2023-11-13 | Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads featur… |
CVE-2023-6102 | Medium | 5.3 | 2023-11-13 | A vulnerability, which was classified as problematic, was found in Maiwei Safety Production Control Platform 4.1. Affected is an unknown function of the file /… |
CVE-2023-47129 | High | 8.3 | 2023-11-10 | Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP f… |
CVE-2023-42659 | Critical | 9.1 | 2023-11-07 | In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the abili… |
CVE-2023-33480 | High | 8.8 | 2023-11-07 | RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users… |
CVE-2023-5601 | Critical | 9.8 | 2023-11-06 | The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to uplo… |
CVE-2023-41725 | High | 7.8 | 2023-11-03 | Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability |
CVE-2023-41357 | High | 8.8 | 2023-11-03 | Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload… |
CVE-2023-5919 | Medium | 4.7 | 2023-11-02 | A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2023-42802 | Critical | 10.0 | 2023-11-02 | GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one… |
CVE-2023-5860 | High | 7.2 | 2023-11-02 | The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions u… |
CVE-2023-46428 | High | 8.8 | 2023-11-01 | An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file. |
CVE-2023-20196 | Medium | 4.7 | 2023-11-01 | Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilitie… |
CVE-2023-20195 | Medium | 4.7 | 2023-11-01 | Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilitie… |
CVE-2023-1720 | Critical | 9.6 | 2023-11-01 | Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and… |
CVE-2023-1713 | High | 8.8 | 2023-11-01 | Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authentic… |
CVE-2023-40050 | Critical | 9.9 | 2023-10-31 | Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted… |
CVE-2023-5360 | Critical | 9.8 | 2023-10-31 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to u… |
CVE-2023-42803 | Medium | 5.3 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocum… |
CVE-2023-5829 | Medium | 6.3 | 2023-10-27 | A vulnerability was found in code-projects Admission Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-46815 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. B… |
CVE-2023-5812 | Medium | 4.7 | 2023-10-27 | A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tool… |
CVE-2023-5796 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting… |
CVE-2023-5795 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in CodeAstro POS System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5790 | Medium | 6.3 | 2023-10-26 | A vulnerability classified as critical was found in SourceCodester File Manager App 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-45555 | High | 7.8 | 2023-10-25 | File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file. |
CVE-2023-45554 | Critical | 9.8 | 2023-10-25 | File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, a… |
CVE-2023-26578 | High | 8.8 | 2023-10-25 | Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP… |
CVE-2023-5524 | High | 8.2 | 2023-10-20 | Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execu… |
CVE-2020-36706 | Critical | 9.8 | 2023-10-20 | The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/js… |
CVE-2023-45384 | Critical | 9.8 | 2023-10-19 | KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Lo… |
CVE-2023-37502 | Critical | 9.0 | 2023-10-18 | HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a us… |
CVE-2023-46004 | High | 7.2 | 2023-10-18 | Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function. |
CVE-2023-41631 | High | 8.8 | 2023-10-17 | eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function. |
CVE-2023-45952 | Critical | 9.8 | 2023-10-17 | An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-44824 | High | 7.8 | 2023-10-17 | An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component. |
CVE-2023-34207 | Critical | 9.9 | 2023-10-17 | Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authent… |
CVE-2022-22375 | High | 7.2 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2011-10004 | Medium | 6.3 | 2023-10-17 | A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file upl… |
CVE-2023-35018 | Low | 3.3 | 2023-10-16 | IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382. |
CVE-2023-45856 | Critical | 9.8 | 2023-10-14 | qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. |
CVE-2023-44962 | Medium | 5.3 | 2023-10-11 | File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component. |
CVE-2023-5493 | Medium | 6.3 | 2023-10-10 | A vulnerability has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928 and classified as critical. Aff… |
CVE-2023-5492 | Medium | 6.3 | 2023-10-10 | A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928… |
CVE-2023-5491 | Medium | 6.3 | 2023-10-10 | A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230… |
CVE-2023-5490 | Medium | 6.3 | 2023-10-10 | A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This vulnera… |
CVE-2023-5489 | Medium | 6.3 | 2023-10-10 | A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This af… |
CVE-2023-5488 | Medium | 6.3 | 2023-10-10 | A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. It has been rated as critical. Affe… |
CVE-2023-44763 | Medium | 5.4 | 2023-10-10 | Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendo… |
CVE-2023-43696 | High | 8.2 | 2023-10-09 | Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP serve… |
CVE-2023-45353 | High | 8.8 | 2023-10-09 | Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary code on the operating… |
CVE-2023-44061 | High | 8.8 | 2023-10-06 | File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload function in the edit… |
CVE-2023-43269 | Critical | 9.8 | 2023-10-05 | pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2023-43321 | High | 8.8 | 2023-10-04 | File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the wget function in the… |
CVE-2023-43838 | High | 7.8 | 2023-10-04 | An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a… |
CVE-2023-44974 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2023-44973 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craf… |
CVE-2023-4817 | High | 7.2 | 2023-10-03 | This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entir… |
CVE-2022-47893 | Critical | 10.0 | 2023-10-03 | There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, t… |
CVE-2023-4097 | High | 8.8 | 2023-10-03 | The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log… |
CVE-2023-44009 | Critical | 9.8 | 2023-10-02 | File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function. |
CVE-2023-44008 | Critical | 9.8 | 2023-10-02 | File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function. |
CVE-2023-5227 | Critical | 9.8 | 2023-09-30 | Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2023-5284 | Medium | 6.3 | 2023-09-29 | A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_st… |