CWE-434 · Unrestricted Upload of File with Dangerous Type (page 6)
Page 6 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-57795 | Critical | 9.9 | 2026-01-28 | Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, th… |
CVE-2025-57794 | Critical | 9.1 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does… |
CVE-2020-36973 | Medium | 6.5 | 2026-01-28 | PDW File Browser 1.3 contains a remote code execution vulnerability that allows authenticated users to upload and rename webshell files to arbitrary web server… |
CVE-2026-1400 | High | 7.2 | 2026-01-28 | The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2025-69559 | Critical | 9.8 | 2026-01-27 | code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php. |
CVE-2025-69565 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php. |
CVE-2020-36942 | High | 8.8 | 2026-01-27 | Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Att… |
CVE-2026-24815 | | 2026-01-27 | Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/ex… | |
CVE-2026-1445 | Medium | 4.7 | 2026-01-26 | A vulnerability was found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This vulnerability affects unknown code of the file contr… |
CVE-2026-1424 | Medium | 4.7 | 2026-01-26 | A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulation leads to unre… |
CVE-2026-1423 | Medium | 6.3 | 2026-01-26 | A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /admin_pic.php… |
CVE-2026-0911 | High | 7.5 | 2026-01-24 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validatio… |
CVE-2025-13374 | Critical | 9.8 | 2026-01-24 | The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in a… |
CVE-2025-70457 | Critical | 9.8 | 2026-01-23 | A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fai… |
CVE-2021-47904 | High | 8.8 | 2026-01-23 | PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious P… |
CVE-2021-47899 | Medium | 4.0 | 2026-01-23 | YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote fi… |
CVE-2021-47888 | High | 8.8 | 2026-01-23 | Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files. Att… |
CVE-2025-69828 | Critical | 10.0 | 2026-01-22 | File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo… |
CVE-2025-69312 | Critical | 9.1 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.Thi… |
CVE-2025-68986 | Critical | 9.9 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: fro… |
CVE-2025-68910 | Critical | 9.9 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects Blogzee: from n/a… |
CVE-2025-68909 | Critical | 9.9 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogistic blogistic allows Using Malicious Files.This issue affects Blogistic: fro… |
CVE-2025-68001 | Critical | 10.0 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue af… |
CVE-2025-67968 | Critical | 9.9 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Rea… |
CVE-2025-62056 | Critical | 9.9 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes News Event news-event.This issue affects News Event: from n/a through <= 1.0.1. |
CVE-2025-62050 | Critical | 9.9 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogmatic blogmatic.This issue affects Blogmatic: from n/a through <= 1.0.3. |
CVE-2025-50002 | Critical | 10.0 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Upload a Web Shell to a Web Server.This issue affects Energia: f… |
CVE-2025-10856 | High | 8.1 | 2026-01-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affec… |
CVE-2026-1331 | Critical | 9.8 | 2026-01-22 | MeetingHub developed by HAMASTAR Technology has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web she… |
CVE-2026-24034 | Medium | 5.4 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered be… |
CVE-2026-24010 | High | 8.0 | 2026-01-22 | Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Enginee… |
CVE-2026-23499 | Medium | 5.4 | 2026-01-21 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or A… |
CVE-2025-33015 | High | 8.8 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. |
CVE-2026-1222 | High | 7.2 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and ex… |
CVE-2025-55251 | Low | 3.1 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |
CVE-2026-1152 | Medium | 4.7 | 2026-01-19 | A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Hand… |
CVE-2026-1126 | Medium | 6.3 | 2026-01-18 | A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \flow-m… |
CVE-2026-1107 | Medium | 6.3 | 2026-01-18 | A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handl… |
CVE-2026-1061 | Medium | 6.3 | 2026-01-17 | A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller… |
CVE-2025-14632 | Medium | 4.4 | 2026-01-17 | The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and in… |
CVE-2012-10064 | | 2026-01-16 | Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plug… | |
CVE-2026-21625 | High | 8.8 | 2026-01-16 | User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks ar… |
CVE-2025-14894 | Critical | 9.8 | 2026-01-16 | Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, a… |
CVE-2025-12957 | High | 8.8 | 2026-01-16 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficie… |
CVE-2021-47788 | High | 8.8 | 2026-01-16 | WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code… |
CVE-2021-47783 | Medium | 5.4 | 2026-01-16 | Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can u… |
CVE-2011-10041 | | 2026-01-15 | Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type valid… | |
CVE-2025-67079 | Critical | 9.8 | 2026-01-15 | File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted… |
CVE-2025-67077 | High | 8.8 | 2026-01-15 | File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile a… |
CVE-2021-47819 | Critical | 9.8 | 2026-01-15 | ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution cap… |
CVE-2021-47758 | High | 8.8 | 2026-01-15 | Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins th… |
CVE-2021-47757 | High | 8.8 | 2026-01-15 | Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated a… |
CVE-2021-47753 | Critical | 9.8 | 2026-01-15 | phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension… |
CVE-2025-13062 | High | 8.8 | 2026-01-15 | The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.5.62. This is due to insufficient… |
CVE-2022-50939 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path t… |
CVE-2022-50936 | High | 8.8 | 2026-01-13 | WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel… |
CVE-2022-50916 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import… |
CVE-2022-50912 | Critical | 9.8 | 2026-01-13 | ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers c… |
CVE-2022-50907 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files… |
CVE-2022-50898 | High | 8.8 | 2026-01-13 | NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated atta… |
CVE-2022-50893 | Critical | 9.8 | 2026-01-13 | VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a maliciou… |
CVE-2025-37175 | High | 7.2 | 2026-01-13 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Succe… |
CVE-2025-62182 | | 2026-01-13 | Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potential… | |
CVE-2025-65783 | Critical | 9.8 | 2026-01-13 | An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute ar… |
CVE-2026-0496 | Medium | 6.6 | 2026-01-13 | SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) without proper file form… |
CVE-2026-22799 | High | 8.8 | 2026-01-12 | Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The… |
CVE-2026-22789 | Medium | 5.4 | 2026-01-12 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 contains a file upload validation bypass v… |
CVE-2026-22786 | High | 7.2 | 2026-01-12 | Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload… |
CVE-2025-66802 | Critical | 9.8 | 2026-01-12 | Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receives a reverse shell (php) into imagem of… |
CVE-2026-22783 | Critical | 9.6 | 2026-01-12 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore fil… |
CVE-2025-46068 | High | 8.8 | 2026-01-12 | An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism |
CVE-2025-15503 | High | 7.3 | 2026-01-10 | A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file… |
CVE-2025-15495 | Medium | 4.7 | 2026-01-09 | A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. The manipulation of the argument… |
CVE-2025-67325 | Critical | 9.8 | 2026-01-08 | Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execu… |
CVE-2026-22241 | High | 7.2 | 2026-01-08 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability… |
CVE-2025-67924 | Critical | 9.9 | 2026-01-08 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload a Web Shell to a Web Server.This issue affects Corpki… |
CVE-2025-67910 | Critical | 9.1 | 2026-01-08 | Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue… |
CVE-2019-25296 | Critical | 9.8 | 2026-01-08 | The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and… |
CVE-2026-21877 | Critical | 9.9 | 2026-01-08 | n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8… |
CVE-2025-66837 | Medium | 6.8 | 2026-01-07 | A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware |
CVE-2026-0643 | High | 7.3 | 2026-01-07 | A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the c… |
CVE-2025-15158 | High | 8.8 | 2026-01-07 | The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function i… |
CVE-2025-14842 | Medium | 6.1 | 2026-01-07 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up… |
CVE-2025-30996 | Critical | 9.9 | 2026-01-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify… |
CVE-2023-50897 | Critical | 9.1 | 2026-01-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Rename… |
CVE-2025-31048 | Critical | 9.9 | 2026-01-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a thr… |
CVE-2025-15240 | High | 8.8 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload a… |
CVE-2025-15448 | Medium | 6.3 | 2026-01-05 | A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/c… |
CVE-2026-0577 | Medium | 6.3 | 2026-01-04 | A flaw has been found in code-projects Online Product Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /handgunne… |
CVE-2026-0566 | Medium | 4.7 | 2026-01-02 | A security vulnerability has been detected in code-projects Content Management System 1.0. Impacted is an unknown function of the file /admin/edit_posts.php. T… |
CVE-2026-0547 | Medium | 6.3 | 2026-01-02 | A vulnerability was found in PHPGurukul Online Course Registration up to 3.1. This issue affects some unknown processing of the file /admin/edit-student-profil… |
CVE-2025-15426 | High | 7.3 | 2026-01-02 | A vulnerability was identified in jackying H-ui.admin up to 3.1. This affects an unknown function in the library /lib/webuploader/0.1.5/server/preview.php. The… |
CVE-2025-15423 | Medium | 6.3 | 2026-01-02 | A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipula… |
CVE-2025-15415 | Medium | 4.7 | 2026-01-01 | A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component… |
CVE-2025-15404 | Medium | 6.3 | 2026-01-01 | A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.p… |
CVE-2025-67707 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-67706 | Medium | 5.6 | 2025-12-31 | ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload… |
CVE-2025-15360 | Medium | 4.7 | 2025-12-30 | A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadCo… |
CVE-2025-15262 | Medium | 4.7 | 2025-12-30 | A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo H… |
CVE-2025-68562 | Critical | 9.9 | 2025-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a… |