CWE-434 · Unrestricted Upload of File with Dangerous Type (page 29)
Page 29 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36431 | Critical | 9.8 | 2022-12-01 | An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted J… |
CVE-2022-4232 | Medium | 4.7 | 2022-11-30 | A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation… |
CVE-2022-44354 | Critical | 9.8 | 2022-11-29 | SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file. |
CVE-2022-38140 | High | 7.6 | 2022-11-28 | Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress. |
CVE-2022-44401 | Critical | 9.8 | 2022-11-28 | Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php. |
CVE-2022-44400 | Critical | 9.8 | 2022-11-28 | Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info. |
CVE-2022-45476 | Critical | 9.8 | 2022-11-25 | Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible… |
CVE-2022-41705 | Critical | 9.8 | 2022-11-25 | Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does… |
CVE-2022-45039 | High | 7.2 | 2022-11-25 | An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2021-43258 | High | 8.8 | 2022-11-23 | CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchIn… |
CVE-2020-23591 | Critical | 9.8 | 2022-11-23 | A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm… |
CVE-2022-2791 | Medium | 5.9 | 2022-11-22 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any… |
CVE-2022-30529 | High | 7.2 | 2022-11-22 | File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/… |
CVE-2022-42698 | Critical | 9.8 | 2022-11-18 | Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. |
CVE-2022-40200 | Critical | 9.9 | 2022-11-17 | Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-43192 | Medium | 6.7 | 2022-11-17 | An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a craf… |
CVE-2022-44384 | High | 8.8 | 2022-11-17 | An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-43234 | Critical | 9.8 | 2022-11-16 | An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-43265 | Critical | 9.8 | 2022-11-15 | An arbitrary file upload vulnerability in the component /pages/save_user.php of Canteen Management System v1.0 allows attackers to execute arbitrary code via a… |
CVE-2022-43146 | High | 7.2 | 2022-11-14 | An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted… |
CVE-2022-3944 | Medium | 6.3 | 2022-11-11 | A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file applicat… |
CVE-2022-40981 | Medium | 5.9 | 2022-11-10 | All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to sto… |
CVE-2022-43074 | Critical | 9.8 | 2022-11-10 | AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers… |
CVE-2022-39036 | Critical | 9.8 | 2022-11-10 | The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulner… |
CVE-2022-43277 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ip/youthappam/php_action/editFile.php. This vulnerability a… |
CVE-2022-40797 | Critical | 9.8 | 2022-11-09 | Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5… |
CVE-2022-43050 | High | 7.2 | 2022-11-07 | Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulner… |
CVE-2022-44054 | Critical | 9.8 | 2022-11-07 | The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor ins… |
CVE-2022-44053 | Critical | 9.8 | 2022-11-07 | The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backd… |
CVE-2022-44052 | Critical | 9.8 | 2022-11-07 | The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-44051 | Critical | 9.8 | 2022-11-07 | The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-44050 | Critical | 9.8 | 2022-11-07 | The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backd… |
CVE-2022-44049 | Critical | 9.8 | 2022-11-07 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-44048 | Critical | 9.8 | 2022-11-07 | The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor in… |
CVE-2022-43306 | High | 8.8 | 2022-11-07 | The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-43305 | Critical | 9.8 | 2022-11-07 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-43304 | Critical | 9.8 | 2022-11-07 | The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-43303 | Critical | 9.8 | 2022-11-07 | The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-3537 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uplo… |
CVE-2022-43061 | High | 7.2 | 2022-11-03 | Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. Thi… |
CVE-2022-3575 | Critical | 9.8 | 2022-11-02 | Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the confi… |
CVE-2022-43085 | High | 7.2 | 2022-11-01 | An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-43083 | High | 7.2 | 2022-11-01 | An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary code via a crafted PHP fil… |
CVE-2022-39019 | Medium | 6.3 | 2022-10-31 | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicatio… |
CVE-2022-42925 | Critical | 9.9 | 2022-10-31 | There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in… |
CVE-2022-41681 | Critical | 9.9 | 2022-10-31 | There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in… |
CVE-2022-40471 | Critical | 9.8 | 2022-10-31 | Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in… |
CVE-2022-3771 | Medium | 6.3 | 2022-10-31 | A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the com… |
CVE-2022-43283 | Medium | 5.5 | 2022-10-28 | wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write. |
CVE-2022-43231 | High | 7.2 | 2022-10-28 | Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_website.php. This vulnerability allows a… |
CVE-2022-37426 | Medium | 4.3 | 2022-10-28 | Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. |
CVE-2022-43275 | High | 7.2 | 2022-10-28 | Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_action/editProductImage.php. This vulnerabi… |
CVE-2022-33859 | High | 8.1 | 2022-10-28 | A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduc… |
CVE-2021-38397 | Critical | 10.0 | 2022-10-28 | Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbi… |
CVE-2022-39978 | High | 7.2 | 2022-10-27 | Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerab… |
CVE-2022-39977 | High | 7.2 | 2022-10-27 | Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability al… |
CVE-2022-41711 | Critical | 9.8 | 2022-10-25 | Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does… |
CVE-2022-36452 | Critical | 9.8 | 2022-10-25 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A succ… |
CVE-2022-39305 | Critical | 9.8 | 2022-10-24 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a fi… |
CVE-2022-42189 | High | 7.2 | 2022-10-21 | Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability. |
CVE-2022-42201 | High | 7.2 | 2022-10-20 | Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload. |
CVE-2022-42198 | High | 8.8 | 2022-10-20 | In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload. |
CVE-2022-31366 | High | 7.2 | 2022-10-20 | An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code v… |
CVE-2022-39301 | High | 8.2 | 2022-10-19 | sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vuln… |
CVE-2022-41537 | High | 7.2 | 2022-10-18 | Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user_operations/profile.php… |
CVE-2022-41504 | High | 7.2 | 2022-10-18 | An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary c… |
CVE-2020-8974 | Critical | 10.0 | 2022-10-17 | In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker… |
CVE-2022-3552 | High | 7.2 | 2022-10-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1. |
CVE-2022-32176 | Critical | 9.0 | 2022-10-17 | In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compres… |
CVE-2022-42029 | High | 8.8 | 2022-10-17 | Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/m… |
CVE-2022-42154 | Critical | 9.8 | 2022-10-17 | An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to execute arbitrary code via a crafted PHP… |
CVE-2022-3549 | Medium | 4.7 | 2022-10-17 | A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown proces… |
CVE-2022-32177 | Critical | 9.0 | 2022-10-14 | In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Norm… |
CVE-2022-41539 | High | 8.8 | 2022-10-14 | Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/users_add.php. This vulnerability allows attacker… |
CVE-2022-41538 | High | 8.8 | 2022-10-14 | Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Management-PHP/admin/photos_add.php. This vulne… |
CVE-2022-41534 | High | 7.2 | 2022-10-13 | Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php. Th… |
CVE-2022-41533 | High | 7.2 | 2022-10-13 | Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/editProductImage.ph… |
CVE-2022-3458 | Medium | 6.3 | 2022-10-12 | A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2022-41406 | High | 7.2 | 2022-10-12 | An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a… |
CVE-2022-40921 | High | 7.2 | 2022-10-12 | DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php. |
CVE-2022-40777 | High | 8.8 | 2022-10-11 | Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .p… |
CVE-2022-42044 | Critical | 9.8 | 2022-10-11 | The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-42043 | Critical | 9.8 | 2022-10-11 | The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-… |
CVE-2022-42040 | Critical | 9.8 | 2022-10-11 | The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the demo… |
CVE-2022-42039 | Critical | 9.8 | 2022-10-11 | The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritu… |
CVE-2022-42038 | Critical | 9.8 | 2022-10-11 | The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the de… |
CVE-2022-42037 | Critical | 9.8 | 2022-10-11 | The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-42036 | Critical | 9.8 | 2022-10-11 | The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41387 | Critical | 9.8 | 2022-10-11 | The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41386 | Critical | 9.8 | 2022-10-11 | The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democri… |
CVE-2022-41385 | Critical | 9.8 | 2022-10-11 | The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41384 | Critical | 9.8 | 2022-10-11 | The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democri… |
CVE-2022-41383 | Critical | 9.8 | 2022-10-11 | The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democr… |
CVE-2022-41382 | Critical | 9.8 | 2022-10-11 | The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41381 | Critical | 9.8 | 2022-10-11 | The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democri… |
CVE-2022-41380 | Critical | 9.8 | 2022-10-11 | The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-42229 | High | 8.8 | 2022-10-11 | Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php. |
CVE-2022-42034 | High | 8.8 | 2022-10-11 | Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php. |
CVE-2022-3436 | Medium | 6.3 | 2022-10-09 | A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-41379 | High | 7.2 | 2022-10-07 | An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execu… |