CWE-434 · Unrestricted Upload of File with Dangerous Type (page 7)
Page 7 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27480 | Critical | 9.8 | 2025-12-29 | givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. |
CVE-2024-25182 | Critical | 9.8 | 2025-12-29 | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. |
CVE-2025-15199 | Medium | 6.3 | 2025-12-29 | A security vulnerability has been detected in code-projects College Notes Uploading System 1.0. Impacted is an unknown function of the file /dashboard/userprof… |
CVE-2025-55061 | High | 8.8 | 2025-12-29 | CWE-434 Unrestricted Upload of File with Dangerous Type |
CVE-2025-15197 | Medium | 4.7 | 2025-12-29 | A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects unknown code of the… |
CVE-2025-57460 | Critical | 9.8 | 2025-12-29 | File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell. |
CVE-2025-15228 | Critical | 9.8 | 2025-12-29 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web s… |
CVE-2025-15226 | Critical | 9.8 | 2025-12-29 | WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, there… |
CVE-2025-52691 | Critical | 10.0 | 2025-12-29 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially… |
CVE-2025-15067 | High | 7.7 | 2025-12-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Innorix Innorix WP allows Upload a Web Shell to a Web Server.This issue affects Innorix WP fro… |
CVE-2025-15152 | Medium | 6.3 | 2025-12-28 | A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the f… |
CVE-2025-15110 | Medium | 4.7 | 2025-12-27 | A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/… |
CVE-2025-15109 | High | 7.3 | 2025-12-27 | A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupl… |
CVE-2025-2155 | High | 8.8 | 2025-12-24 | Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. Thi… |
CVE-2025-15050 | Medium | 6.3 | 2025-12-24 | A security vulnerability has been detected in code-projects Student File Management System 1.0. This affects an unknown part of the file /save_file.php. Such m… |
CVE-2025-51511 | Critical | 9.8 | 2025-12-23 | Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads. |
CVE-2023-53980 | Critical | 9.8 | 2025-12-22 | ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can… |
CVE-2023-53971 | High | 8.8 | 2025-12-22 | WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. A… |
CVE-2025-67288 | Critical | 10.0 | 2025-12-22 | An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is dispute… |
CVE-2025-67289 | Critical | 9.6 | 2025-12-22 | An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-15009 | Medium | 6.3 | 2025-12-22 | A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload… |
CVE-2025-14800 | High | 8.1 | 2025-12-21 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload… |
CVE-2025-13329 | Critical | 9.8 | 2025-12-20 | The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for… |
CVE-2023-53956 | High | 8.8 | 2025-12-19 | Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager… |
CVE-2023-53952 | High | 8.8 | 2025-12-19 | Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through t… |
CVE-2023-53950 | Critical | 9.8 | 2025-12-19 | InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file extension restrictions through filename… |
CVE-2025-66908 | Medium | 5.3 | 2025-12-19 | Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrCont… |
CVE-2025-68398 | Critical | 9.1 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavio… |
CVE-2025-14849 | High | 8.8 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. |
CVE-2023-53942 | High | 8.8 | 2025-12-18 | File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Att… |
CVE-2019-25229 | High | 8.8 | 2025-12-18 | An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC f… |
CVE-2025-14885 | Medium | 6.3 | 2025-12-18 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads… |
CVE-2025-66074 | Critical | 9.0 | 2025-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from… |
CVE-2025-64374 | Critical | 9.9 | 2025-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a… |
CVE-2025-64231 | Critical | 9.9 | 2025-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-conta… |
CVE-2023-53933 | High | 8.8 | 2025-12-17 | Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attack… |
CVE-2023-53924 | High | 8.8 | 2025-12-17 | UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension durin… |
CVE-2023-53922 | Critical | 9.8 | 2025-12-17 | TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious… |
CVE-2023-53921 | Critical | 9.8 | 2025-12-17 | SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory. Attackers… |
CVE-2025-68109 | Critical | 9.1 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file exte… |
CVE-2025-67164 | Critical | 9.9 | 2025-12-17 | An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via up… |
CVE-2025-66449 | High | 8.8 | 2025-12-16 | ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on th… |
CVE-2023-53892 | High | 7.2 | 2025-12-15 | Blackcat CMS 1.4 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the jquery plugi… |
CVE-2023-53889 | High | 7.2 | 2025-12-15 | Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through the assets manageme… |
CVE-2023-53885 | High | 7.2 | 2025-12-15 | Webutler v3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload PHP files with system command execution. Attack… |
CVE-2023-53876 | Medium | 5.4 | 2025-12-15 | Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. A… |
CVE-2023-53871 | Critical | 9.8 | 2025-12-15 | Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers ca… |
CVE-2023-53869 | | 2025-12-15 | WEBIGniter 28.7.23 contains a file upload vulnerability that allows authenticated attackers to upload and execute dangerous PHP files through the media functio… | |
CVE-2023-53868 | High | 8.8 | 2025-12-15 | Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin m… |
CVE-2024-44599 | High | 8.3 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Directory Traversal. |
CVE-2024-44598 | High | 8.8 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. |
CVE-2025-14642 | Medium | 4.7 | 2025-12-14 | A vulnerability has been found in code-projects Computer Laboratory System 1.0. Impacted is an unknown function of the file technical_staff_pic.php. Such manip… |
CVE-2025-14641 | Medium | 4.7 | 2025-12-14 | A flaw has been found in code-projects Computer Laboratory System 1.0. This issue affects some unknown processing of the file admin/admin_pic.php. This manipul… |
CVE-2025-13094 | High | 8.8 | 2025-12-13 | The WP3D Model Import Viewer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_import_file() funct… |
CVE-2025-14583 | High | 7.3 | 2025-12-12 | A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipula… |
CVE-2025-14582 | Medium | 4.7 | 2025-12-12 | A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile… |
CVE-2025-12968 | High | 8.8 | 2025-12-12 | The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up t… |
CVE-2025-34506 | High | 8.8 | 2025-12-11 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attacker… |
CVE-2024-58313 | High | 7.2 | 2025-12-11 | xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrar… |
CVE-2024-58298 | | 2025-12-11 | Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP fil… | |
CVE-2024-58295 | | 2025-12-11 | ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme ins… | |
CVE-2025-14530 | Medium | 4.7 | 2025-12-11 | A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property… |
CVE-2025-65474 | Critical | 9.8 | 2025-12-11 | An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via re… |
CVE-2025-65471 | High | 8.8 | 2025-12-11 | An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via up… |
CVE-2025-14522 | Medium | 6.3 | 2025-12-11 | A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kin… |
CVE-2024-58283 | High | 8.8 | 2025-12-10 | WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder fi… |
CVE-2024-58282 | High | 7.2 | 2025-12-10 | Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media uploa… |
CVE-2024-58281 | High | 8.8 | 2025-12-10 | Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functio… |
CVE-2024-58279 | High | 8.8 | 2025-12-10 | appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the file… |
CVE-2020-36897 | Critical | 9.8 | 2025-12-10 | QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload mali… |
CVE-2025-14390 | High | 8.8 | 2025-12-10 | The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version <= 5.0.4. This is due to missing or incorrect nonce validation o… |
CVE-2025-67506 | Critical | 9.8 | 2025-12-10 | PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buf… |
CVE-2025-61808 | Critical | 9.1 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to ar… |
CVE-2025-56704 | High | 8.8 | 2025-12-09 | LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated… |
CVE-2025-14219 | Medium | 4.7 | 2025-12-08 | A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_runni… |
CVE-2025-14199 | Medium | 6.3 | 2025-12-07 | A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=… |
CVE-2025-14195 | Medium | 6.3 | 2025-12-07 | A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_qu… |
CVE-2025-13065 | High | 8.8 | 2025-12-06 | The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient fil… |
CVE-2025-12966 | High | 8.8 | 2025-12-06 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory()… |
CVE-2025-12673 | Critical | 9.8 | 2025-12-06 | The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in… |
CVE-2020-36882 | High | 7.5 | 2025-12-05 | Flexsense DiskBoss 7.7.14 allows unauthenticated attackers to upload arbitrary files via /Command/Search Files/Directory field, leading to a denial of service… |
CVE-2025-65897 | High | 8.8 | 2025-12-05 | zdh_web is a data collection, processing, monitoring, scheduling, and management platform. In zdh_web thru 5.6.17, insufficient validation of file upload paths… |
CVE-2025-12181 | High | 8.8 | 2025-12-05 | The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all ve… |
CVE-2025-12154 | High | 8.8 | 2025-12-05 | The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb() function in all vers… |
CVE-2025-12153 | High | 8.8 | 2025-12-05 | The Featured Image via URL plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation function in all versions up to, and… |
CVE-2025-13066 | High | 8.8 | 2025-12-05 | The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6. This is due to insufficient fil… |
CVE-2025-13543 | High | 8.8 | 2025-12-04 | The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions… |
CVE-2025-65806 | Medium | 4.3 | 2025-12-04 | The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP containing another ZI… |
CVE-2025-65027 | High | 7.6 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestric… |
CVE-2025-13949 | Medium | 6.3 | 2025-12-03 | A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileController.go. The ma… |
CVE-2025-13646 | High | 7.5 | 2025-12-03 | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in… |
CVE-2025-65844 | High | 7.5 | 2025-12-02 | EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessib… |
CVE-2025-13827 | | 2025-12-02 | Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf the media folder is… | |
CVE-2025-13516 | High | 8.1 | 2025-12-02 | The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0… |
CVE-2025-13815 | Medium | 6.3 | 2025-12-01 | A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation… |
CVE-2025-51736 | Medium | 6.3 | 2025-11-28 | File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-13536 | High | 8.8 | 2025-11-27 | The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and includi… |
CVE-2025-66256 | Critical | 9.8 | 2025-11-26 | Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 100… |
CVE-2025-66255 | Critical | 9.8 | 2025-11-26 | Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1… |
CVE-2025-66250 | Critical | 9.8 | 2025-11-26 | Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 10… |