CWE-434 · Unrestricted Upload of File with Dangerous Type (page 33)
Page 33 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25411 | Critical | 9.8 | 2022-02-28 | A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-23906 | High | 7.2 | 2022-02-28 | CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploite… |
CVE-2022-26149 | High | 7.2 | 2022-02-26 | MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable F… |
CVE-2021-44664 | High | 8.8 | 2022-02-24 | An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously craf… |
CVE-2022-25360 | High | 8.8 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnera… |
CVE-2022-23043 | High | 7.2 | 2022-02-24 | Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then… |
CVE-2021-44967 | High | 8.8 | 2022-02-24 | A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user uplo… |
CVE-2022-24553 | Critical | 9.8 | 2022-02-21 | An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution. |
CVE-2022-23375 | High | 8.8 | 2022-02-19 | WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through i… |
CVE-2022-0409 | High | 7.8 | 2022-02-19 | Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2. |
CVE-2021-46036 | Critical | 9.8 | 2022-02-18 | An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code. |
CVE-2022-24984 | Critical | 9.8 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files an… |
CVE-2022-23390 | Critical | 9.8 | 2022-02-14 | An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files. |
CVE-2021-22803 | Critical | 9.8 | 2022-02-11 | A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an att… |
CVE-2020-13675 | Critical | 9.8 | 2022-02-11 | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an acces… |
CVE-2022-23048 | High | 7.2 | 2022-02-09 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload… |
CVE-2021-37194 | High | 7.5 | 2022-02-09 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-46360 | High | 8.8 | 2022-02-09 | Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell throug… |
CVE-2022-24676 | High | 8.8 | 2022-02-09 | update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive. |
CVE-2021-24947 | Medium | 6.5 | 2022-02-07 | The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_i… |
CVE-2022-0472 | Medium | 5.4 | 2022-02-04 | Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9. |
CVE-2022-23329 | Critical | 9.8 | 2022-02-04 | A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading maliciou… |
CVE-2022-24262 | High | 8.8 | 2022-02-04 | The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbit… |
CVE-2021-46428 | Critical | 9.8 | 2022-01-27 | A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avatar parameter in Sys… |
CVE-2021-46097 | High | 8.8 | 2022-01-27 | Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log |
CVE-2021-46386 | Critical | 9.8 | 2022-01-26 | File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.a… |
CVE-2021-46116 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which at… |
CVE-2021-46115 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upl… |
CVE-2021-44123 | High | 8.8 | 2022-01-26 | SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double exte… |
CVE-2022-23026 | Medium | 4.3 | 2022-01-25 | On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, an authentica… |
CVE-2021-46033 | Critical | 9.8 | 2022-01-25 | In ForestBlog, as of 2021-12-28, File upload can bypass verification. |
CVE-2021-46113 | High | 8.8 | 2022-01-25 | In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file uplo… |
CVE-2022-23315 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. |
CVE-2022-22929 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a cr… |
CVE-2021-45808 | High | 8.8 | 2022-01-19 | jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server. |
CVE-2021-46013 | Critical | 9.8 | 2022-01-18 | An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable r… |
CVE-2022-0263 | High | 7.8 | 2022-01-18 | Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7. |
CVE-2021-41550 | High | 7.2 | 2022-01-18 | Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code. |
CVE-2021-38697 | Critical | 9.8 | 2022-01-18 | SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead t… |
CVE-2022-0242 | High | 7.2 | 2022-01-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0. |
CVE-2021-33828 | High | 8.8 | 2022-01-15 | The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share… |
CVE-2021-34997 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-34995 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-45411 | Critical | 9.8 | 2022-01-12 | In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file… |
CVE-2021-44651 | High | 8.8 | 2022-01-12 | Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security… |
CVE-2021-4080 | High | 8.8 | 2022-01-12 | crater is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-43973 | High | 8.8 | 2022-01-11 | An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file vi… |
CVE-2021-46079 | High | 7.2 | 2022-01-06 | An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading… |
CVE-2021-46078 | Medium | 4.8 | 2022-01-06 | An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading… |
CVE-2021-46076 | High | 8.8 | 2022-01-06 | Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious php file in multiple endpoints it leading… |
CVE-2021-44031 | Critical | 9.8 | 2021-12-22 | An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerabi… |
CVE-2021-24981 | High | 7.5 | 2021-12-21 | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in th… |
CVE-2021-35244 | Medium | 6.8 | 2021-12-20 | The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker… |
CVE-2021-44164 | Critical | 9.8 | 2021-12-20 | Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file ty… |
CVE-2021-44159 | Critical | 9.8 | 2021-12-20 | 4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshell files without aut… |
CVE-2021-23814 | Medium | 6.7 | 2021-12-17 | This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploadi… |
CVE-2021-41560 | Critical | 9.8 | 2021-12-15 | OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. |
CVE-2021-41870 | High | 8.8 | 2021-12-15 | An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. An authenticated attacker can bypass a client-side file-type check and… |
CVE-2021-43829 | High | 7.4 | 2021-12-14 | PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in… |
CVE-2021-40883 | Critical | 9.8 | 2021-12-14 | A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. |
CVE-2021-43117 | Critical | 9.8 | 2021-12-13 | fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access. |
CVE-2021-27984 | High | 8.1 | 2021-12-10 | In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files. |
CVE-2021-36719 | High | 8.8 | 2021-12-08 | PineApp - Mail Secure - The attacker must be logged in as a user to the Pineapp system. The attacker exploits the vulnerable nicUpload.php file to upload a mal… |
CVE-2021-27860 | Critical | 9.8 | 2021-12-08 | A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unau… |
CVE-2021-42133 | High | 8.1 | 2021-12-07 | An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitr… |
CVE-2021-42125 | High | 8.8 | 2021-12-07 | An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous fil… |
CVE-2021-43936 | Critical | 10.0 | 2021-12-06 | The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's… |
CVE-2021-23562 | Medium | 4.2 | 2021-12-03 | This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upl… |
CVE-2020-29176 | High | 7.8 | 2021-12-02 | An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file. |
CVE-2021-42099 | Critical | 9.8 | 2021-11-30 | Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution. |
CVE-2021-42123 | High | 7.3 | 2021-11-30 | Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows… |
CVE-2021-44094 | High | 7.8 | 2021-11-28 | ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file |
CVE-2021-44093 | Critical | 9.8 | 2021-11-28 | A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file… |
CVE-2021-22968 | High | 7.2 | 2021-11-19 | A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 a… |
CVE-2021-42362 | High | 8.8 | 2021-11-17 | The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.ph… |
CVE-2021-39222 | Medium | 6.4 | 2021-11-15 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerabil… |
CVE-2021-42839 | High | 8.8 | 2021-11-15 | Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upl… |
CVE-2021-43617 | Critical | 9.8 | 2021-11-14 | Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.ph… |
CVE-2021-3915 | Medium | 5.7 | 2021-11-13 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-41833 | Critical | 9.8 | 2021-11-11 | Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution. |
CVE-2020-23572 | High | 8.8 | 2021-11-08 | BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php. This vulnerability allows attackers to execu… |
CVE-2021-28023 | Critical | 9.8 | 2021-11-08 | Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading… |
CVE-2021-34685 | Low | 2.7 | 2021-11-08 | UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upl… |
CVE-2021-31599 | High | 8.8 | 2021-11-08 | An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusio… |
CVE-2021-42669 | Critical | 9.8 | 2021-11-05 | A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher… |
CVE-2020-18261 | Critical | 9.8 | 2021-11-03 | An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands. |
CVE-2021-26740 | Critical | 9.8 | 2021-11-01 | Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code. |
CVE-2021-38847 | High | 8.8 | 2021-11-01 | S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows att… |
CVE-2018-25019 | High | 7.5 | 2021-11-01 | The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_i… |
CVE-2021-41646 | Critical | 9.8 | 2021-10-29 | Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the ima… |
CVE-2021-41645 | High | 8.8 | 2021-10-29 | Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user to inject arbitrar… |
CVE-2021-41644 | Critical | 9.8 | 2021-10-29 | Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image up… |
CVE-2021-41643 | Critical | 9.8 | 2021-10-29 | Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field. |
CVE-2021-41675 | High | 7.2 | 2021-10-29 | A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert function, which vali… |
CVE-2021-36548 | Critical | 9.8 | 2021-10-28 | A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers t… |
CVE-2021-36547 | Critical | 9.8 | 2021-10-28 | A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a c… |
CVE-2021-3745 | Medium | 6.6 | 2021-10-28 | flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-3906 | Medium | 6.5 | 2021-10-27 | bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
CVE-2021-37221 | High | 8.8 | 2021-10-27 | A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option, which… |
CVE-2021-37372 | High | 8.8 | 2021-10-26 | Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating thei… |