CWE-434 · Unrestricted Upload of File with Dangerous Type (page 31)
Page 31 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31854 | High | 7.2 | 2022-07-07 | Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel. |
CVE-2015-1785 | Medium | 6.5 | 2022-07-07 | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The… |
CVE-2015-1784 | High | 8.8 | 2022-07-07 | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The… |
CVE-2022-32413 | Critical | 9.8 | 2022-07-05 | An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-2268 | High | 7.2 | 2022-07-04 | The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted… |
CVE-2022-31943 | Critical | 9.8 | 2022-07-01 | MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2021-37770 | High | 7.2 | 2022-06-30 | Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htacce… |
CVE-2022-32994 | Critical | 9.8 | 2022-06-27 | Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. |
CVE-2022-31086 | High | 8.8 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 inco… |
CVE-2022-2212 | Medium | 6.3 | 2022-06-27 | A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the component… |
CVE-2021-38945 | Critical | 9.8 | 2022-06-24 | IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validation. IBM X-Force ID… |
CVE-2022-2102 | Critical | 9.4 | 2022-06-24 | Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modif… |
CVE-2022-1519 | Critical | 10.0 | 2022-06-24 | LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code th… |
CVE-2013-1916 | High | 8.8 | 2022-06-24 | In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting Wo… |
CVE-2022-31362 | High | 8.8 | 2022-06-23 | Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. NOTE: This vulnerability only affects products that… |
CVE-2021-40954 | Critical | 9.8 | 2022-06-23 | Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary code. |
CVE-2022-31374 | Critical | 9.8 | 2022-06-21 | An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file. |
CVE-2022-2128 | Critical | 9.8 | 2022-06-20 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. |
CVE-2022-1939 | High | 7.2 | 2022-06-20 | The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP f… |
CVE-2017-20063 | Medium | 6.3 | 2022-06-20 | A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of… |
CVE-2022-2111 | High | 8.8 | 2022-06-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2021-41421 | Medium | 4.8 | 2022-06-16 | A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel. |
CVE-2022-32433 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to Arbitrary code execution via ip/school/view/all_teacher.php. |
CVE-2021-40940 | Critical | 9.8 | 2022-06-15 | Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability. |
CVE-2021-42675 | Critical | 9.8 | 2022-06-14 | Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution. |
CVE-2022-31041 | High | 7.6 | 2022-06-13 | Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be conf… |
CVE-2022-0863 | High | 7.2 | 2022-06-13 | The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload… |
CVE-2017-20021 | Medium | 6.5 | 2022-06-09 | A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85. This affects an unknown part of the component File Upload… |
CVE-2021-35532 | Medium | 6.7 | 2022-06-07 | A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious age… |
CVE-2022-30860 | High | 7.2 | 2022-06-06 | FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel. |
CVE-2022-32019 | Critical | 9.8 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.php?action=save_car. |
CVE-2021-45982 | High | 8.8 | 2022-06-02 | NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user. |
CVE-2022-30822 | High | 8.8 | 2022-06-02 | In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file. |
CVE-2022-30821 | High | 8.8 | 2022-06-02 | In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability… |
CVE-2022-30820 | High | 8.8 | 2022-06-02 | In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file. |
CVE-2022-30819 | High | 8.8 | 2022-06-02 | In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file. |
CVE-2022-30808 | Critical | 9.8 | 2022-06-02 | elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php. |
CVE-2022-30506 | Critical | 9.8 | 2022-06-02 | An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file. |
CVE-2022-30423 | Critical | 9.8 | 2022-06-02 | Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information. |
CVE-2022-29725 | High | 8.8 | 2022-06-02 | An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-29624 | High | 8.8 | 2022-06-02 | An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-24581 | High | 7.5 | 2022-06-02 | ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, a… |
CVE-2022-24239 | Critical | 9.8 | 2022-06-02 | ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. |
CVE-2021-33615 | High | 7.5 | 2022-06-02 | RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type. |
CVE-2021-26634 | Critical | 9.8 | 2022-06-02 | SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboa… |
CVE-2022-29637 | High | 7.8 | 2022-05-26 | An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file. |
CVE-2022-29632 | Critical | 9.8 | 2022-05-26 | An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a craf… |
CVE-2022-29651 | High | 7.2 | 2022-05-25 | An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafte… |
CVE-2021-42654 | Critical | 9.8 | 2022-05-24 | SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code. |
CVE-2022-1837 | Medium | 4.7 | 2022-05-24 | A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand… |
CVE-2022-1811 | Medium | 5.4 | 2022-05-23 | Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9. |
CVE-2022-1752 | High | 8.0 | 2022-05-21 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-30887 | Critical | 9.8 | 2022-05-20 | Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This… |
CVE-2022-28104 | Critical | 9.8 | 2022-05-20 | Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-28927 | Critical | 9.8 | 2022-05-19 | A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters. |
CVE-2021-41938 | High | 7.2 | 2022-05-19 | An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations. |
CVE-2022-22482 | Medium | 6.5 | 2022-05-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to upload files that could f… |
CVE-2022-30007 | High | 7.2 | 2022-05-17 | GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then ren… |
CVE-2022-1409 | High | 7.2 | 2022-05-16 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators… |
CVE-2022-1103 | High | 8.8 | 2022-05-16 | The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to R… |
CVE-2021-25119 | High | 7.2 | 2022-05-16 | The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high p… |
CVE-2022-29623 | High | 7.8 | 2022-05-16 | An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted P… |
CVE-2022-29622 | Critical | 9.8 | 2022-05-16 | An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute… |
CVE-2022-29354 | Critical | 9.8 | 2022-05-16 | An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-29353 | Critical | 9.8 | 2022-05-16 | An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename. |
CVE-2022-29351 | Critical | 9.8 | 2022-05-16 | An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note… |
CVE-2021-33009 | High | 7.5 | 2022-05-13 | mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system. |
CVE-2021-42967 | Critical | 9.8 | 2022-05-13 | Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker t… |
CVE-2021-27771 | High | 8.2 | 2022-05-12 | User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with… |
CVE-2022-21809 | High | 8.1 | 2022-05-12 | A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arb… |
CVE-2022-30448 | Critical | 9.8 | 2022-05-11 | Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php. |
CVE-2022-29655 | High | 7.2 | 2022-05-11 | An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary code via a crafted P… |
CVE-2022-29318 | High | 7.2 | 2022-05-11 | An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PH… |
CVE-2020-19228 | High | 7.2 | 2022-05-11 | An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files. |
CVE-2021-42645 | Critical | 10.0 | 2022-05-10 | CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to uploa… |
CVE-2022-28606 | Critical | 9.8 | 2022-05-05 | An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain con… |
CVE-2022-28120 | Critical | 9.8 | 2022-05-05 | Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which… |
CVE-2022-1411 | Medium | 6.1 | 2022-05-05 | Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retriev… |
CVE-2022-29347 | Critical | 9.8 | 2022-05-04 | An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file. |
CVE-2022-28568 | Critical | 9.8 | 2022-05-04 | Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote… |
CVE-2022-29001 | High | 7.2 | 2022-05-03 | In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability |
CVE-2022-20743 | Medium | 6.5 | 2022-05-03 | A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass sec… |
CVE-2022-1273 | High | 7.2 | 2022-05-02 | The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary… |
CVE-2022-29451 | High | 8.8 | 2022-04-29 | Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to… |
CVE-2021-43934 | Critical | 9.8 | 2022-04-28 | Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload… |
CVE-2021-41921 | Critical | 9.8 | 2022-04-28 | novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution. |
CVE-2022-28528 | High | 8.8 | 2022-04-26 | bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit. |
CVE-2022-28525 | High | 8.8 | 2022-04-26 | ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_user&id=1. |
CVE-2021-26628 | High | 8.1 | 2022-04-26 | Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu… |
CVE-2022-27468 | Critical | 9.8 | 2022-04-26 | Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file uploaded to the web se… |
CVE-2022-22392 | High | 7.8 | 2022-04-25 | IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in co… |
CVE-2021-4225 | High | 8.8 | 2022-04-25 | The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to pre… |
CVE-2021-39040 | High | 8.0 | 2022-04-25 | IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes. Attackers can make use of this wea… |
CVE-2022-28053 | High | 8.8 | 2022-04-25 | Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerability allows attackers to execute arbitr… |
CVE-2022-28440 | High | 8.8 | 2022-04-21 | An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-28021 | Critical | 9.8 | 2022-04-21 | Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=user. |
CVE-2022-27478 | High | 8.8 | 2022-04-21 | Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin. |
CVE-2022-27862 | Critical | 9.8 | 2022-04-19 | Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute da… |
CVE-2022-1329 | High | 8.8 | 2022-04-19 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/c… |
CVE-2021-4096 | High | 8.8 | 2022-04-19 | The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers… |