CWE-434 · Unrestricted Upload of File with Dangerous Type (page 25)
Page 25 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5277 | Medium | 6.3 | 2023-09-29 | A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of… |
CVE-2023-5262 | Medium | 6.3 | 2023-09-29 | A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. Affected by this vulnerability is the function isImg of the file /admin/… |
CVE-2023-5185 | Critical | 9.1 | 2023-09-28 | Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authent… |
CVE-2023-43740 | High | 8.8 | 2023-09-28 | Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of admin_edit.php page, allowing an authenticate… |
CVE-2023-43226 | High | 8.8 | 2023-09-28 | An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2022-47186 | High | 7.5 | 2023-09-28 | There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any… |
CVE-2023-38874 | High | 8.8 | 2023-09-28 | A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious… |
CVE-2023-42462 | High | 7.7 | 2023-09-27 | GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses… |
CVE-2023-40219 | High | 7.2 | 2023-09-27 | Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory. |
CVE-2023-39377 | High | 7.2 | 2023-09-27 | SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous fil… |
CVE-2023-5154 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-8000 up to 20151231 and classified as critical. This vulnerability affects unknown… |
CVE-2023-5150 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown fu… |
CVE-2023-5149 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been rated as critical. This issue affects some unknown pro… |
CVE-2023-5148 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability… |
CVE-2023-5147 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part o… |
CVE-2023-5146 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is… |
CVE-2023-5145 | Medium | 6.3 | 2023-09-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is… |
CVE-2023-5144 | Medium | 6.3 | 2023-09-24 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unk… |
CVE-2023-40183 | High | 7.5 | 2023-09-21 | DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain us… |
CVE-2023-42335 | High | 8.8 | 2023-09-20 | Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code via the add attachme… |
CVE-2023-42331 | High | 8.8 | 2023-09-20 | A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component. |
CVE-2023-43497 | High | 8.1 | 2023-09-20 | In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system te… |
CVE-2023-43478 | High | 8.8 | 2023-09-20 | fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images an… |
CVE-2023-41902 | High | 7.8 | 2023-09-20 | An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious… |
CVE-2023-43619 | High | 7.8 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file. |
CVE-2023-38887 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the e… |
CVE-2023-36319 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the compress-inc.php file. |
CVE-2023-5034 | Medium | 6.3 | 2023-09-18 | A vulnerability classified as problematic was found in SourceCodester My Food Recipe 1.0. This vulnerability affects unknown code of the file index.php of the… |
CVE-2023-41626 | Medium | 4.8 | 2023-09-15 | Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface. |
CVE-2023-4988 | Medium | 6.3 | 2023-09-15 | A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action… |
CVE-2023-42180 | High | 8.8 | 2023-09-14 | An arbitrary file upload vulnerability in the /user/upload component of lenosp 1.0-1.2.0 allows attackers to execute html code via a crafted JPG file. |
CVE-2023-30962 | Medium | 6.8 | 2023-09-12 | The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to la… |
CVE-2023-40784 | Critical | 9.8 | 2023-09-12 | DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php. |
CVE-2023-2071 | Critical | 9.8 | 2023-09-12 | Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve… |
CVE-2023-40731 | Medium | 5.7 | 2023-09-12 | A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary file types. This could… |
CVE-2023-42472 | High | 8.7 | 2023-09-12 | Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report c… |
CVE-2023-41564 | Medium | 6.1 | 2023-09-08 | An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .s… |
CVE-2023-39424 | Critical | 9.9 | 2023-09-07 | A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web… |
CVE-2023-41009 | Critical | 9.8 | 2023-09-05 | File Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute arbitrary code via a crafted script to the authorization field in the… |
CVE-2023-3375 | High | 7.2 | 2023-09-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0. |
CVE-2023-41108 | High | 8.8 | 2023-09-05 | TEF portal 2023-07-17 is vulnerable to authenticated remote code execution. |
CVE-2023-4739 | Medium | 6.3 | 2023-09-03 | A vulnerability, which was classified as critical, has been found in Byzoro Smart S85F Management Platform up to 20230820. Affected by this issue is some unkno… |
CVE-2023-40980 | Critical | 9.8 | 2023-09-01 | File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile… |
CVE-2023-41638 | High | 8.8 | 2023-08-31 | An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploa… |
CVE-2023-41637 | Critical | 9.8 | 2023-08-31 | An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploadin… |
CVE-2023-4596 | Critical | 9.8 | 2023-08-30 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server… |
CVE-2020-18912 | Critical | 9.8 | 2023-08-29 | An issue found in Earcms Ear App v.20181124 allows a remote attacker to execute arbitrary code via the uload/index-uplog.php. |
CVE-2023-40825 | High | 7.2 | 2023-08-28 | An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list. |
CVE-2023-38029 | Critical | 9.8 | 2023-08-28 | Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthe… |
CVE-2023-4559 | Medium | 6.3 | 2023-08-27 | A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file inde… |
CVE-2023-32757 | Critical | 9.8 | 2023-08-25 | e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging t… |
CVE-2023-24517 | Medium | 6.4 | 2023-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( un… |
CVE-2023-38836 | High | 8.8 | 2023-08-21 | File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. |
CVE-2023-4409 | Medium | 6.3 | 2023-08-18 | A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manip… |
CVE-2023-39970 | Critical | 9.8 | 2023-08-17 | Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution. |
CVE-2023-31946 | High | 7.2 | 2023-08-17 | File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the artical.p… |
CVE-2023-31941 | High | 7.2 | 2023-08-17 | File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the employee_… |
CVE-2023-39115 | Critical | 9.8 | 2023-08-16 | install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document. |
CVE-2023-38915 | Critical | 9.8 | 2023-08-15 | File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function. |
CVE-2023-28482 | Medium | 6.5 | 2023-08-14 | An issue was discovered in Tigergraph Enterprise 3.7.0. A single TigerGraph instance can host multiple graphs that are accessed by multiple different users. Th… |
CVE-2023-28480 | Medium | 6.5 | 2023-08-14 | An issue was discovered in Tigergraph Enterprise 3.7.0. The TigerGraph platform allows users to define new User Defined Functions (UDFs) from C/C++ code. To su… |
CVE-2020-36082 | Critical | 9.8 | 2023-08-11 | File Upload vulnerability in bloofoxCMS version 0.5.2.1, allows remote attackers to execute arbitrary code and escalate privileges via crafted webshell file to… |
CVE-2023-32564 | Critical | 9.8 | 2023-08-10 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove… |
CVE-2023-32562 | Critical | 9.8 | 2023-08-10 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove… |
CVE-2023-39776 | Critical | 9.8 | 2023-08-10 | A File Upload vulnerability in PHPJabbers Ticket Support Script v3.2 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2023-4243 | High | 8.8 | 2023-08-09 | The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due… |
CVE-2023-4186 | Medium | 6.3 | 2023-08-06 | A vulnerability was found in SourceCodester Pharmacy Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2020-23564 | High | 7.2 | 2023-08-05 | File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php. |
CVE-2023-39346 | High | 8.8 | 2023-08-04 | LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 all… |
CVE-2023-4159 | High | 8.8 | 2023-08-04 | Unrestricted Upload of File with Dangerous Type in GitHub repository omeka/omeka-s prior to 4.0.3. |
CVE-2023-38947 | High | 7.2 | 2023-08-03 | An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP… |
CVE-2023-36299 | High | 8.8 | 2023-08-03 | A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php. |
CVE-2023-36298 | High | 8.8 | 2023-08-03 | DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE). |
CVE-2023-4121 | Medium | 6.3 | 2023-08-03 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The man… |
CVE-2023-36212 | High | 8.8 | 2023-08-03 | File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page function. |
CVE-2023-38330 | Medium | 5.3 | 2023-08-02 | OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file… |
CVE-2023-31428 | Medium | 5.5 | 2023-08-02 | Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dump files under user'… |
CVE-2023-39147 | High | 7.8 | 2023-08-01 | An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. |
CVE-2023-33493 | Critical | 9.8 | 2023-08-01 | An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3… |
CVE-2023-32225 | Critical | 9.8 | 2023-07-30 | Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filety… |
CVE-2023-37677 | Critical | 9.8 | 2023-07-25 | Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.php. |
CVE-2023-34798 | Critical | 9.8 | 2023-07-25 | An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2022-46899 | High | 7.5 | 2023-07-25 | An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Arbitrary File Upload. The BaseController class, that each of the se… |
CVE-2023-3486 | High | 8.2 | 2023-07-25 | An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the… |
CVE-2023-32637 | Critical | 9.8 | 2023-07-25 | GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload f… |
CVE-2022-28863 | High | 8.8 | 2023-07-24 | An issue was discovered in Nokia NetAct 22. A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload p… |
CVE-2023-3852 | Medium | 4.7 | 2023-07-23 | A vulnerability was found in OpenRapid RapidCMS up to 1.3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/uploa… |
CVE-2023-3836 | Medium | 6.3 | 2023-07-22 | A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. This vulnerability affects unknown code of the file /emap/devic… |
CVE-2023-3806 | Medium | 6.3 | 2023-07-21 | A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an unknown function of… |
CVE-2023-3804 | Medium | 5.5 | 2023-07-21 | A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code… |
CVE-2023-3803 | Low | 2.6 | 2023-07-21 | A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the… |
CVE-2023-3802 | Medium | 5.5 | 2023-07-21 | A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some u… |
CVE-2023-3800 | Low | 3.9 | 2023-07-20 | A vulnerability was found in EasyAdmin8 2.0.2.2. It has been classified as problematic. Affected is an unknown function of the file /admin/index/index.html#/ad… |
CVE-2023-3798 | Medium | 5.5 | 2023-07-20 | A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown… |
CVE-2023-3797 | Medium | 5.5 | 2023-07-20 | A vulnerability, which was classified as critical, was found in Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Wa… |
CVE-2023-3796 | Medium | 4.3 | 2023-07-20 | A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0. Affected by this issue is some unknown functionality of th… |
CVE-2023-37289 | Critical | 9.8 | 2023-07-20 | It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and… |
CVE-2023-34394 | High | 7.8 | 2023-07-19 | In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM… |
CVE-2023-3722 | High | 8.6 | 2023-07-19 | An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server use… |
CVE-2022-40896 | Medium | 5.5 | 2023-07-19 | A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. |