CWE-434 · Unrestricted Upload of File with Dangerous Type (page 26)
Page 26 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-35189 | Critical | 10.0 | 2023-07-18 | Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a mali… |
CVE-2020-22159 | High | 8.8 | 2023-07-18 | EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Upload, allowing an authenticated attacker… |
CVE-2023-38404 | High | 7.2 | 2023-07-17 | The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the… |
CVE-2023-3692 | High | 7.2 | 2023-07-16 | Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10. |
CVE-2023-30791 | High | 7.1 | 2023-07-15 | Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML extension that interprets both HTML and… |
CVE-2023-37839 | Critical | 9.8 | 2023-07-13 | An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-3342 | Critical | 9.9 | 2023-07-13 | The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the 'u… |
CVE-2023-34136 | Critical | 9.8 | 2023-07-13 | Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issu… |
CVE-2023-34126 | High | 8.8 | 2023-07-13 | Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue aff… |
CVE-2023-37629 | Critical | 9.8 | 2023-07-12 | Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php." |
CVE-2023-3626 | Medium | 6.3 | 2023-07-11 | A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 202… |
CVE-2023-3625 | Medium | 6.3 | 2023-07-11 | A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This vulne… |
CVE-2023-3623 | Medium | 6.3 | 2023-07-11 | A vulnerability was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230704. It has been rated as critical. Af… |
CVE-2023-37656 | Critical | 9.8 | 2023-07-11 | WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload. |
CVE-2023-37152 | Critical | 9.8 | 2023-07-10 | Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. Note: This has been dis… |
CVE-2023-34193 | High | 8.8 | 2023-07-06 | File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the Clien… |
CVE-2023-36969 | High | 8.8 | 2023-07-06 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. |
CVE-2020-21861 | High | 8.8 | 2023-07-06 | File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload. |
CVE-2023-36809 | High | 8.1 | 2023-07-05 | Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had int… |
CVE-2023-37208 | High | 7.8 | 2023-07-05 | When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR <… |
CVE-2023-3504 | Medium | 6.3 | 2023-07-04 | A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /sett… |
CVE-2023-3503 | Medium | 6.3 | 2023-07-04 | A vulnerability has been found in SourceCodester Shopping Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2020-22153 | Critical | 9.8 | 2023-07-03 | File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigat… |
CVE-2020-22151 | Critical | 9.8 | 2023-07-03 | Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload… |
CVE-2023-3491 | High | 8.8 | 2023-06-30 | Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. |
CVE-2023-32621 | High | 7.2 | 2023-06-30 | WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the r… |
CVE-2020-18432 | Critical | 9.8 | 2023-06-30 | File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges. |
CVE-2023-34738 | Critical | 9.8 | 2023-06-29 | Chemex through 3.7.1 is vulnerable to arbitrary file upload. |
CVE-2023-34736 | High | 7.2 | 2023-06-28 | Guantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload. |
CVE-2022-44276 | Critical | 9.8 | 2023-06-28 | In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE. |
CVE-2023-32526 | Medium | 6.5 | 2023-06-26 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected insta… |
CVE-2023-32525 | Medium | 6.5 | 2023-06-26 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected insta… |
CVE-2023-33404 | Critical | 9.8 | 2023-06-26 | An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote a… |
CVE-2020-20210 | High | 8.8 | 2023-06-26 | Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. |
CVE-2023-36630 | High | 8.8 | 2023-06-25 | In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass. |
CVE-2023-1721 | Critical | 9.1 | 2023-06-24 | Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correct… |
CVE-2023-27083 | High | 7.2 | 2023-06-22 | An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality. |
CVE-2023-36097 | Critical | 9.8 | 2023-06-22 | funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install. |
CVE-2020-21489 | Critical | 9.8 | 2023-06-20 | File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component. |
CVE-2020-21474 | Critical | 9.8 | 2023-06-20 | File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter. |
CVE-2020-21325 | High | 8.8 | 2023-06-20 | An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file. |
CVE-2020-21174 | Critical | 9.8 | 2023-06-20 | File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function. |
CVE-2020-20969 | High | 7.2 | 2023-06-20 | File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file. |
CVE-2020-20919 | High | 7.2 | 2023-06-20 | File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file. |
CVE-2020-20735 | Critical | 9.8 | 2023-06-20 | File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter. |
CVE-2020-20718 | Critical | 9.8 | 2023-06-20 | File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file()… |
CVE-2020-20067 | High | 8.8 | 2023-06-20 | File upload vulnerability in ebCMS v.1.1.0 allows a remote attacker to execute arbitrary code via the upload type parameter. |
CVE-2023-35808 | High | 8.8 | 2023-06-17 | An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes… |
CVE-2023-3295 | High | 8.8 | 2023-06-17 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio… |
CVE-2023-34660 | Medium | 6.5 | 2023-06-16 | jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface. |
CVE-2023-34845 | Medium | 5.4 | 2023-06-16 | Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to exe… |
CVE-2023-32753 | Critical | 9.8 | 2023-06-16 | OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability t… |
CVE-2023-32752 | Critical | 9.8 | 2023-06-16 | L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote… |
CVE-2023-34833 | Medium | 6.1 | 2023-06-15 | An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file. |
CVE-2023-3274 | Medium | 6.3 | 2023-06-15 | A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of the file btn_function… |
CVE-2022-33166 | High | 7.2 | 2023-06-15 | IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically pro… |
CVE-2023-34747 | Critical | 9.8 | 2023-06-14 | File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. |
CVE-2023-34944 | Critical | 9.8 | 2023-06-13 | An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via upl… |
CVE-2023-31541 | Critical | 9.8 | 2023-06-13 | A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbit… |
CVE-2023-3049 | Critical | 9.8 | 2023-06-13 | Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. This issue affects Lockcell: before 15. |
CVE-2023-33253 | High | 8.8 | 2023-06-12 | LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system com… |
CVE-2023-3187 | Medium | 6.3 | 2023-06-09 | A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown f… |
CVE-2023-27881 | High | 8.0 | 2023-06-07 | A user could use the “Upload Resource” functionality to upload files to any location on the disk. |
CVE-2023-33498 | High | 8.8 | 2023-06-07 | alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file. |
CVE-2020-36705 | Critical | 9.8 | 2023-06-07 | The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in v… |
CVE-2023-33601 | High | 8.8 | 2023-06-07 | An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-4949 | High | 8.8 | 2023-06-07 | The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to… |
CVE-2021-4382 | High | 8.8 | 2023-06-07 | The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in version… |
CVE-2021-4354 | High | 8.8 | 2023-06-07 | The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_uploader function i… |
CVE-2020-36701 | High | 8.8 | 2023-06-07 | The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_actio… |
CVE-2019-25138 | Critical | 9.8 | 2023-06-07 | The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in v… |
CVE-2016-15033 | Critical | 9.8 | 2023-06-07 | The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php… |
CVE-2023-33569 | High | 7.2 | 2023-06-06 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update_user. |
CVE-2023-32628 | High | 7.2 | 2023-06-06 | In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of… |
CVE-2023-22450 | High | 7.2 | 2023-06-06 | In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a… |
CVE-2023-29631 | Critical | 9.8 | 2023-06-05 | PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php. |
CVE-2020-19028 | High | 7.5 | 2023-06-05 | *File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function. |
CVE-2023-33386 | Critical | 9.8 | 2023-06-05 | MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background. |
CVE-2023-3061 | Medium | 6.3 | 2023-06-02 | A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file… |
CVE-2023-3032 | High | 8.1 | 2023-06-02 | Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload… |
CVE-2023-28700 | Medium | 6.8 | 2023-06-02 | OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator pri… |
CVE-2023-28699 | High | 8.8 | 2023-06-02 | Wade Graphic Design FANTSY has a vulnerability of insufficient filtering for file type in its file update function. An authenticated remote attacker with gener… |
CVE-2023-2063 | Medium | 6.3 | 2023-06-02 | Unrestricted Upload of File with Dangerous Type vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP9… |
CVE-2014-125104 | Medium | 6.3 | 2023-06-01 | A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function prote… |
CVE-2023-33508 | Critical | 9.8 | 2023-05-31 | KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE). |
CVE-2023-28353 | High | 8.8 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teache… |
CVE-2023-32689 | Medium | 6.3 | 2023-05-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a p… |
CVE-2023-2924 | Medium | 4.7 | 2023-05-27 | A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of… |
CVE-2023-32686 | High | 8.1 | 2023-05-27 | Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test case… |
CVE-2023-22504 | Medium | 6.5 | 2023-05-25 | Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments v… |
CVE-2023-2888 | Medium | 4.7 | 2023-05-25 | A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0… |
CVE-2023-29721 | Critical | 9.8 | 2023-05-24 | SofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution. |
CVE-2023-28409 | Critical | 9.8 | 2023-05-23 | Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload a… |
CVE-2023-27397 | Critical | 9.8 | 2023-05-23 | Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. If the product's file upload function and server save op… |
CVE-2023-31689 | Critical | 9.8 | 2023-05-22 | In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the text… |
CVE-2023-2712 | Critical | 9.8 | 2023-05-20 | Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command In… |
CVE-2023-30333 | Critical | 9.8 | 2023-05-18 | An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a craf… |
CVE-2023-2776 | Medium | 6.3 | 2023-05-17 | A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been declared as critical. This vulnerability affects unknown code. The manipulatio… |
CVE-2023-31903 | Critical | 9.8 | 2023-05-17 | GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file. |
CVE-2023-31857 | Critical | 9.8 | 2023-05-16 | Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/U… |