CWE-434 · Unrestricted Upload of File with Dangerous Type (page 27)
Page 27 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2738 | Medium | 6.3 | 2023-05-16 | A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipu… |
CVE-2023-31576 | High | 8.8 | 2023-05-16 | An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file. |
CVE-2023-30247 | Critical | 9.8 | 2023-05-12 | File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the update_sett… |
CVE-2023-29657 | High | 8.8 | 2023-05-12 | eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executio… |
CVE-2021-34076 | High | 8.8 | 2023-05-11 | File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload. |
CVE-2023-2648 | Medium | 6.3 | 2023-05-11 | A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify… |
CVE-2023-29930 | High | 8.8 | 2023-05-10 | An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetia… |
CVE-2023-28128 | High | 7.2 | 2023-05-09 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove… |
CVE-2023-24507 | High | 8.8 | 2023-05-08 | AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request. |
CVE-2021-28998 | High | 7.2 | 2023-05-08 | File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file. |
CVE-2021-27280 | High | 7.8 | 2023-05-08 | OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected. |
CVE-2020-22755 | High | 8.8 | 2023-05-08 | File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943. |
CVE-2023-30185 | Critical | 9.8 | 2023-05-08 | CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php. |
CVE-2023-30090 | Critical | 9.8 | 2023-05-05 | Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to e… |
CVE-2023-30122 | Critical | 9.8 | 2023-05-05 | An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitr… |
CVE-2023-30264 | Critical | 9.8 | 2023-05-04 | CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update. |
CVE-2023-2523 | High | 7.3 | 2023-05-04 | A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax… |
CVE-2022-47878 | High | 8.8 | 2023-05-02 | Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as We… |
CVE-2023-0924 | High | 7.2 | 2023-05-02 | The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Ad… |
CVE-2023-29635 | Critical | 9.8 | 2023-05-01 | File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload. |
CVE-2022-45802 | Critical | 9.8 | 2023-05-01 | Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high… |
CVE-2023-2424 | Medium | 6.3 | 2023-04-29 | A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/c… |
CVE-2023-2419 | Medium | 4.7 | 2023-04-29 | A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\a… |
CVE-2023-24269 | High | 8.8 | 2023-04-28 | An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2023-29268 | Critical | 9.8 | 2023-04-26 | The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker… |
CVE-2022-25277 | High | 7.2 | 2023-04-26 | Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prev… |
CVE-2023-30266 | High | 8.8 | 2023-04-26 | CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. |
CVE-2022-36769 | High | 7.2 | 2023-04-26 | IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the p… |
CVE-2023-26098 | High | 8.2 | 2023-04-25 | An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code. |
CVE-2023-30613 | High | 8.1 | 2023-04-24 | Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, th… |
CVE-2023-1731 | High | 7.2 | 2023-04-24 | In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authe… |
CVE-2023-25132 | Critical | 9.1 | 2023-04-24 | Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPane… |
CVE-2023-2246 | Medium | 6.3 | 2023-04-23 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the fi… |
CVE-2023-2245 | Medium | 6.3 | 2023-04-22 | A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ash… |
CVE-2023-28962 | Medium | 5.3 | 2023-04-17 | An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based… |
CVE-2023-27755 | High | 8.8 | 2023-04-17 | go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download. |
CVE-2022-34128 | Critical | 9.8 | 2023-04-16 | The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. |
CVE-2023-29627 | High | 8.8 | 2023-04-14 | Online Pizza Ordering v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file… |
CVE-2023-29625 | High | 8.8 | 2023-04-14 | Employee Performance Evaluation System v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code v… |
CVE-2023-29621 | High | 8.8 | 2023-04-14 | Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted… |
CVE-2023-2034 | High | 8.8 | 2023-04-14 | Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. |
CVE-2023-26852 | High | 7.2 | 2023-04-12 | An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted P… |
CVE-2020-19802 | Critical | 9.8 | 2023-04-11 | File Upload vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the upload file type parameter. |
CVE-2023-27179 | High | 7.5 | 2023-04-11 | GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php. |
CVE-2023-27178 | Critical | 9.8 | 2023-04-10 | An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted file. |
CVE-2023-1970 | Medium | 6.3 | 2023-04-10 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the functio… |
CVE-2023-29375 | Critical | 9.8 | 2023-04-10 | An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3… |
CVE-2023-1406 | High | 8.8 | 2023-04-10 | The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execut… |
CVE-2023-27602 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users u… |
CVE-2023-27033 | Critical | 9.8 | 2023-04-07 | Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFrontController::init… |
CVE-2023-1942 | Medium | 6.3 | 2023-04-07 | A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2023-24720 | Critical | 9.8 | 2023-04-05 | An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file. |
CVE-2023-0670 | High | 7.2 | 2023-04-05 | Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through… |
CVE-2023-20134 | Medium | 5.4 | 2023-04-05 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting (X… |
CVE-2023-20073 | Medium | 5.3 | 2023-04-05 | A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, re… |
CVE-2023-26857 | High | 7.2 | 2023-04-05 | An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary… |
CVE-2023-0265 | High | 8.8 | 2023-04-04 | Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly vali… |
CVE-2023-26775 | High | 7.8 | 2023-04-04 | File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the assets/php/upload.php e… |
CVE-2021-3267 | High | 7.2 | 2023-04-04 | File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function. |
CVE-2021-31707 | Critical | 9.8 | 2023-04-04 | Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type. |
CVE-2023-1826 | Medium | 6.3 | 2023-04-04 | A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file p… |
CVE-2023-1728 | Critical | 9.8 | 2023-04-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This… |
CVE-2023-1800 | High | 7.3 | 2023-04-02 | A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file… |
CVE-2023-1797 | Medium | 6.3 | 2023-04-02 | A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=s… |
CVE-2022-47191 | Medium | 4.3 | 2023-03-31 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to esca… |
CVE-2022-47190 | Critical | 10.0 | 2023-03-31 | Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary c… |
CVE-2023-26830 | High | 7.2 | 2023-03-31 | An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attacke… |
CVE-2023-1744 | Medium | 6.3 | 2023-03-30 | A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation lea… |
CVE-2023-1739 | Medium | 6.3 | 2023-03-30 | A vulnerability was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0 and classified as critical. This issue affects some unknown processin… |
CVE-2023-28833 | Low | 2.4 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a… |
CVE-2023-1734 | High | 7.3 | 2023-03-30 | A vulnerability classified as critical has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected is an unknown function of the file ad… |
CVE-2023-28731 | Critical | 9.8 | 2023-03-30 | AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to un… |
CVE-2023-26968 | Critical | 9.8 | 2023-03-29 | In Atrocore 1.5.25, the Create Import Feed option with glyphicon-glyphicon-paperclip function is vulnerable to Unauthenticated File upload. |
CVE-2023-1684 | Medium | 4.7 | 2023-03-29 | A vulnerability was found in HadSky 7.7.16. It has been classified as problematic. This affects an unknown part of the file upload/index.php?c=app&a=superadmin… |
CVE-2023-27246 | High | 8.8 | 2023-03-28 | An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted .htaccess fi… |
CVE-2022-3682 | Critical | 9.9 | 2023-03-28 | A vulnerability exists in the SDM600 file permission validation. An attacker could exploit the vulnerability by gaining access to the system and uploading a s… |
CVE-2023-28652 | Medium | 6.5 | 2023-03-27 | An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition. |
CVE-2023-25828 | High | 7.2 | 2023-03-27 | Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of im… |
CVE-2023-25909 | Critical | 9.8 | 2023-03-27 | HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability… |
CVE-2023-25655 | Critical | 9.8 | 2023-03-23 | baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch. |
CVE-2023-25654 | Critical | 9.8 | 2023-03-23 | baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Ver… |
CVE-2020-19786 | High | 8.8 | 2023-03-23 | File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file. |
CVE-2023-23707 | Medium | 5.9 | 2023-03-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Inn… |
CVE-2023-1561 | Medium | 6.3 | 2023-03-22 | A vulnerability, which was classified as critical, was found in code-projects Simple Online Hotel Reservation System 1.0. Affected is an unknown function of th… |
CVE-2023-1559 | Medium | 4.7 | 2023-03-22 | A vulnerability classified as problematic was found in SourceCodester Storage Unit Rental Management System 1.0. This vulnerability affects unknown code of the… |
CVE-2023-1558 | Medium | 6.3 | 2023-03-22 | A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0. This affects an unknown part of the file uploadera.php… |
CVE-2023-28725 | Critical | 9.1 | 2023-03-22 | General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code… |
CVE-2023-1501 | Medium | 6.3 | 2023-03-19 | A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The mani… |
CVE-2023-1497 | Medium | 6.3 | 2023-03-19 | A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2023-1484 | Medium | 6.3 | 2023-03-18 | A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipula… |
CVE-2023-1479 | Medium | 6.3 | 2023-03-18 | A vulnerability classified as critical has been found in SourceCodester Simple Music Player 1.0. Affected is an unknown function of the file save_music.php. Th… |
CVE-2023-1442 | Medium | 4.7 | 2023-03-17 | A vulnerability was found in Meizhou Qingyunke QYKCMS 4.3.0. It has been classified as problematic. This affects an unknown part of the file /admin_system/api… |
CVE-2023-1433 | Medium | 4.7 | 2023-03-16 | A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the… |
CVE-2023-28337 | High | 8.8 | 2023-03-15 | When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complet… |
CVE-2023-1415 | Medium | 6.3 | 2023-03-15 | A vulnerability was found in Simple Art Gallery 1.0. It has been declared as critical. This vulnerability affects the function sliderPicSubmit of the file admi… |
CVE-2023-27235 | High | 7.2 | 2023-03-15 | An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a craft… |
CVE-2023-27757 | Critical | 9.8 | 2023-03-15 | An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JP… |
CVE-2023-26262 | High | 7.2 | 2023-03-14 | An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to dir… |
CVE-2023-1392 | Medium | 6.3 | 2023-03-14 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is the function sa… |
CVE-2023-1391 | Medium | 4.7 | 2023-03-14 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function… |