CWE-434 · Unrestricted Upload of File with Dangerous Type (page 30)
Page 30 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42092 | High | 7.2 | 2022-10-07 | Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this an… |
CVE-2022-41512 | High | 7.2 | 2022-10-07 | An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute ar… |
CVE-2022-40721 | Critical | 9.8 | 2022-10-03 | Arbitrary file upload vulnerability in php uploader |
CVE-2022-3125 | High | 8.8 | 2022-10-03 | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, l… |
CVE-2022-40886 | High | 7.2 | 2022-10-03 | DedeCMS 5.7.98 has a file upload vulnerability in the background. |
CVE-2022-40341 | High | 8.8 | 2022-09-30 | mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file. |
CVE-2022-41437 | High | 7.2 | 2022-09-30 | Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php. |
CVE-2022-36066 | Critical | 9.1 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-40407 | High | 8.8 | 2022-09-29 | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2021-45790 | Critical | 9.8 | 2022-09-29 | An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can… |
CVE-2022-40048 | High | 7.2 | 2022-09-29 | Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. |
CVE-2022-40878 | High | 8.8 | 2022-09-27 | In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE). |
CVE-2022-37346 | Critical | 9.8 | 2022-09-27 | EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vul… |
CVE-2022-40050 | Critical | 9.8 | 2022-09-26 | ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1. |
CVE-2022-40925 | High | 7.2 | 2022-09-26 | Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the backgr… |
CVE-2022-40924 | High | 7.2 | 2022-09-26 | Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the back… |
CVE-2022-3076 | High | 7.2 | 2022-09-26 | The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the… |
CVE-2022-3257 | Low | 3.1 | 2022-09-23 | Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows auth… |
CVE-2022-40087 | Critical | 9.8 | 2022-09-22 | Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents(). This vulnerability allows att… |
CVE-2022-40932 | High | 7.2 | 2022-09-22 | In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gallery" module in the… |
CVE-2022-40217 | Medium | 6.5 | 2022-09-21 | Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. |
CVE-2022-36386 | Critical | 9.1 | 2022-09-21 | Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. |
CVE-2022-2872 | Medium | 5.4 | 2022-09-21 | Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-38916 | Critical | 9.8 | 2022-09-20 | A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files |
CVE-2022-40432 | Critical | 9.8 | 2022-09-19 | The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypo… |
CVE-2022-40431 | Critical | 9.8 | 2022-09-19 | The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-network… |
CVE-2022-38887 | Critical | 9.8 | 2022-09-19 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The… |
CVE-2022-38886 | Critical | 9.8 | 2022-09-19 | The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings… |
CVE-2022-38885 | Critical | 9.8 | 2022-09-19 | The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-s… |
CVE-2022-38884 | Critical | 9.8 | 2022-09-19 | The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-str… |
CVE-2022-38883 | Critical | 9.8 | 2022-09-19 | The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings… |
CVE-2022-38882 | Critical | 9.8 | 2022-09-19 | The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings… |
CVE-2022-38881 | Critical | 9.8 | 2022-09-19 | The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-str… |
CVE-2022-38877 | High | 7.2 | 2022-09-16 | Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action/editProductImage.php?id=1. |
CVE-2022-38843 | High | 8.8 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may exec… |
CVE-2022-38323 | High | 7.2 | 2022-09-15 | Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php. This vulnerabili… |
CVE-2022-37140 | High | 8.0 | 2022-09-14 | PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A c… |
CVE-2022-36667 | High | 8.8 | 2022-09-14 | Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function. The vulnerability exi… |
CVE-2022-38305 | High | 8.8 | 2022-09-13 | AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. This vulnerability allows attackers to ex… |
CVE-2022-38296 | Critical | 9.8 | 2022-09-12 | Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager. |
CVE-2021-44426 | High | 8.8 | 2022-09-12 | An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary file to a victim's local ~/Downloads/ directory is possible i… |
CVE-2022-3129 | Medium | 6.3 | 2022-09-07 | A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2020-21516 | Critical | 9.8 | 2022-09-06 | There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code. |
CVE-2022-36582 | High | 7.2 | 2022-08-31 | An arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary co… |
CVE-2022-36580 | High | 7.2 | 2022-08-31 | An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute… |
CVE-2022-37184 | High | 8.8 | 2022-08-31 | The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a d… |
CVE-2022-36557 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup function. This vulnerabil… |
CVE-2022-37159 | Critical | 9.8 | 2022-08-25 | Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload. |
CVE-2022-37181 | Critical | 9.8 | 2022-08-24 | 72crm 9.0 has an Arbitrary file upload vulnerability. |
CVE-2022-36285 | High | 7.2 | 2022-08-23 | Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress. |
CVE-2021-29891 | Medium | 4.9 | 2022-08-22 | IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network services. IBM X-For… |
CVE-2022-35150 | Critical | 9.8 | 2022-08-22 | Baijicms v4 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-2594 | High | 8.8 | 2022-08-22 | The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload fil… |
CVE-2022-2909 | Medium | 6.3 | 2022-08-20 | A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2022-2180 | Critical | 9.8 | 2022-08-15 | The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an un… |
CVE-2022-2804 | Medium | 6.3 | 2022-08-12 | A vulnerability was found in SourceCodester Zoo Management System. It has been classified as critical. Affected is an unknown function of the file /pages/apply… |
CVE-2022-2779 | Medium | 6.3 | 2022-08-12 | A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of… |
CVE-2022-2751 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file /d… |
CVE-2022-2750 | Medium | 6.3 | 2022-08-11 | A vulnerability, which was classified as critical, was found in SourceCodester Company Website CMS. Affected is an unknown function of the file /dashboard/add-… |
CVE-2022-2749 | Medium | 4.7 | 2022-08-11 | A vulnerability was found in SourceCodester Gym Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2022-2746 | Medium | 6.3 | 2022-08-11 | A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2022-2744 | Medium | 6.3 | 2022-08-11 | A vulnerability, which was classified as critical, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality… |
CVE-2022-2740 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS. It has been declared as critical. This vulnerability affects unknown code of the file /dashboa… |
CVE-2022-2736 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS. It has been classified as critical. This affects an unknown part of the file /dashboard/update… |
CVE-2022-35426 | Critical | 9.8 | 2022-08-10 | UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file. |
CVE-2022-36264 | Critical | 9.1 | 2022-08-08 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitra… |
CVE-2022-2356 | High | 8.8 | 2022-08-08 | The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead… |
CVE-2022-2046 | Medium | 4.9 | 2022-08-08 | The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the… |
CVE-2022-2694 | Medium | 6.3 | 2022-08-06 | A vulnerability was found in SourceCodester Company Website CMS and classified as critical. This issue affects some unknown processing. The manipulation leads… |
CVE-2022-2678 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in SourceCodester Alphaware Simple E-Commerce System. It has been declared as critical. This vulnerability affects unknown code of th… |
CVE-2022-2647 | High | 7.3 | 2022-08-04 | A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the a… |
CVE-2022-34613 | Critical | 9.8 | 2022-08-02 | Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-34154 | High | 7.2 | 2022-08-01 | Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress. |
CVE-2022-34496 | Critical | 9.8 | 2022-07-29 | Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature. |
CVE-2022-34578 | High | 7.2 | 2022-07-28 | Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page. |
CVE-2022-34120 | High | 7.2 | 2022-07-27 | Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pages/activity/activi… |
CVE-2022-34549 | High | 8.8 | 2022-07-27 | Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate pr… |
CVE-2022-34971 | High | 8.8 | 2022-07-27 | An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP fi… |
CVE-2022-34965 | High | 7.2 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/… |
CVE-2022-34115 | Critical | 9.8 | 2022-07-22 | DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. |
CVE-2022-28700 | Critical | 9.1 | 2022-07-21 | Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. |
CVE-2022-34024 | High | 7.2 | 2022-07-19 | Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at /bmis/pages/reside… |
CVE-2022-1565 | High | 7.2 | 2022-07-18 | The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, a… |
CVE-2022-24688 | High | 8.8 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via… |
CVE-2021-36711 | Critical | 9.8 | 2022-07-16 | WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled. |
CVE-2022-31161 | Critical | 10.0 | 2022-07-15 | Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subproc… |
CVE-2022-32119 | High | 8.8 | 2022-07-15 | Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the… |
CVE-2021-36461 | High | 8.8 | 2022-07-15 | An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictur… |
CVE-2022-2420 | High | 8.0 | 2022-07-15 | A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. Th… |
CVE-2022-2419 | High | 8.0 | 2022-07-15 | A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload… |
CVE-2022-2418 | High | 8.0 | 2022-07-15 | A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The m… |
CVE-2022-22450 | Low | 3.8 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious file by bypassing extension security in an HTTP request. IBM X-Fo… |
CVE-2022-28372 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning… |
CVE-2022-28369 | Critical | 9.8 | 2022-07-14 | Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtc… |
CVE-2022-32114 | High | 8.8 | 2022-07-13 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE… |
CVE-2022-30216 | High | 8.8 | 2022-07-12 | Windows Server Service Tampering Vulnerability |
CVE-2022-31134 | Medium | 4.9 | 2022-07-12 | Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server admi… |
CVE-2022-2297 | Medium | 6.3 | 2022-07-12 | A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the fi… |
CVE-2022-1952 | Critical | 9.8 | 2022-07-11 | The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrar… |
CVE-2021-29281 | Critical | 9.8 | 2022-07-07 | File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-… |