CWE-434 · Unrestricted Upload of File with Dangerous Type (page 8)
Page 8 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13597 | Critical | 9.8 | 2025-11-25 | The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up… |
CVE-2025-13595 | Critical | 9.8 | 2025-11-25 | The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions… |
CVE-2025-13376 | High | 7.2 | 2025-11-25 | The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 0.3.0. T… |
CVE-2023-7330 | | 2025-11-24 | Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied… | |
CVE-2025-13574 | Medium | 4.7 | 2025-11-24 | A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.p… |
CVE-2025-13573 | Medium | 6.3 | 2025-11-24 | A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php… |
CVE-2025-13544 | Medium | 6.3 | 2025-11-23 | A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /custo… |
CVE-2025-12973 | High | 7.2 | 2025-11-21 | The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file typ… |
CVE-2025-13156 | High | 8.8 | 2025-11-21 | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the inser… |
CVE-2025-12138 | High | 8.8 | 2025-11-21 | The URL Image Importer plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and includi… |
CVE-2025-11456 | Critical | 9.8 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… |
CVE-2025-0645 | High | 7.2 | 2025-11-20 | Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing F… |
CVE-2025-13423 | Medium | 4.7 | 2025-11-20 | A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. E… |
CVE-2025-13411 | Medium | 4.7 | 2025-11-19 | A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/a… |
CVE-2025-64759 | High | 8.1 | 2025-11-19 | Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browse… |
CVE-2025-34336 | | 2025-11-19 | eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage… | |
CVE-2025-34330 | Medium | 5.3 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an u… |
CVE-2025-34329 | Critical | 9.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_file… |
CVE-2025-34328 | Critical | 9.8 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an u… |
CVE-2025-12057 | Critical | 9.8 | 2025-11-19 | The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing… |
CVE-2025-63228 | Critical | 9.8 | 2025-11-18 | The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php end… |
CVE-2025-63227 | High | 7.2 | 2025-11-18 | The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint. An… |
CVE-2025-63695 | Critical | 9.8 | 2025-11-18 | DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php. |
CVE-2025-41735 | High | 8.8 | 2025-11-18 | A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution. |
CVE-2025-41347 | Critical | 9.8 | 2025-11-18 | Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'web… |
CVE-2025-13069 | High | 8.8 | 2025-11-18 | The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.3. This is due to in… |
CVE-2025-12775 | High | 8.8 | 2025-11-18 | The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_hand… |
CVE-2025-12528 | High | 8.1 | 2025-11-18 | The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. Thi… |
CVE-2025-12974 | High | 8.1 | 2025-11-18 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in al… |
CVE-2025-63748 | High | 8.8 | 2025-11-17 | QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restri… |
CVE-2025-13275 | Medium | 4.7 | 2025-11-17 | A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of th… |
CVE-2025-13249 | Medium | 6.3 | 2025-11-16 | A security vulnerability has been detected in Jiusi OA up to 20251102. This affects an unknown function of the file /OfficeServer?isAjaxDownloadTemplate=false… |
CVE-2025-13238 | Medium | 6.3 | 2025-11-16 | A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit… |
CVE-2025-13198 | Medium | 4.7 | 2025-11-15 | A vulnerability has been found in DouPHP up to 1.8 Release 20251022. This impacts an unknown function of the file upload/include/file.class.php. The manipulati… |
CVE-2025-13185 | Medium | 4.7 | 2025-11-14 | A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3. This affects an unknown function of the file /admin/dashboard/profile. The manipu… |
CVE-2025-55810 | Medium | 6.8 | 2025-11-13 | A vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, which allows physical… |
CVE-2025-13061 | Medium | 6.3 | 2025-11-12 | A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=manage_voting. Performing m… |
CVE-2025-12048 | High | 7.5 | 2025-11-12 | An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execut… |
CVE-2025-59118 | High | 7.3 | 2025-11-12 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upg… |
CVE-2025-24862 | Low | 2.0 | 2025-11-11 | Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an… |
CVE-2025-12846 | High | 8.8 | 2025-11-11 | The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to in… |
CVE-2025-11170 | Critical | 9.8 | 2025-11-11 | The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import… |
CVE-2025-42883 | Low | 2.7 | 2025-11-11 | Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges… |
CVE-2025-63678 | High | 7.2 | 2025-11-10 | An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Adminis… |
CVE-2021-4462 | Critical | 9.8 | 2025-11-10 | Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files… |
CVE-2025-12867 | High | 7.2 | 2025-11-10 | EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors… |
CVE-2025-12399 | High | 7.2 | 2025-11-08 | The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-jso… |
CVE-2025-11967 | High | 7.2 | 2025-11-08 | The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attribute_import function… |
CVE-2025-12161 | High | 8.8 | 2025-11-08 | The Smart Auto Upload Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the auto-image creation functi… |
CVE-2025-12862 | Medium | 6.3 | 2025-11-07 | A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Affected by this issue is some unknown functionality of the file /dashboard/… |
CVE-2025-34299 | Critical | 9.8 | 2025-11-07 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitra… |
CVE-2025-12352 | Critical | 9.8 | 2025-11-07 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all ver… |
CVE-2025-64176 | Medium | 5.3 | 2025-11-06 | ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish… |
CVE-2025-6327 | Critical | 10.0 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server… |
CVE-2025-62065 | Critical | 9.9 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5. |
CVE-2025-62047 | Critical | 9.9 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through < 1.3.0. |
CVE-2025-62016 | Critical | 9.9 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0. |
CVE-2025-60235 | Critical | 10.0 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Support Ticket System for WooCommerce (Premium) support-ticket-system-for-woocommerce… |
CVE-2025-60207 | Critical | 10.0 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerc… |
CVE-2025-60187 | Medium | 4.8 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Using Malicious Files.This issue affects… |
CVE-2025-58996 | Critical | 9.1 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Upload a Web Shell to a Web Server.Thi… |
CVE-2025-53283 | Critical | 10.0 | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-for… |
CVE-2025-10907 | High | 8.4 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin servic… |
CVE-2025-20376 | Medium | 6.5 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability i… |
CVE-2025-20375 | Medium | 6.5 | 2025-11-05 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability i… |
CVE-2025-20354 | Critical | 9.8 | 2025-11-05 | A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary fil… |
CVE-2025-63601 | Critical | 9.9 | 2025-11-05 | Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing… |
CVE-2025-3125 | Medium | 6.7 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An au… |
CVE-2025-12674 | Critical | 9.8 | 2025-11-05 | The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versio… |
CVE-2025-12682 | Critical | 9.8 | 2025-11-04 | The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_… |
CVE-2025-11724 | High | 8.8 | 2025-11-04 | The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. T… |
CVE-2025-48396 | High | 8.3 | 2025-11-03 | Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the lates… |
CVE-2025-12593 | Medium | 4.7 | 2025-11-02 | A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit… |
CVE-2025-12171 | High | 8.8 | 2025-11-01 | The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function… |
CVE-2025-11755 | High | 8.8 | 2025-11-01 | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing rec… |
CVE-2025-11499 | Critical | 9.8 | 2025-11-01 | The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing f… |
CVE-2025-62618 | High | 8.0 | 2025-10-31 | ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because E… |
CVE-2020-36863 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location. The upload handler did not prop… |
CVE-2025-64095 | Critical | 10.0 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider… |
CVE-2025-62802 | Medium | 4.3 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HT… |
CVE-2025-12378 | High | 7.3 | 2025-10-28 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. P… |
CVE-2025-12347 | Medium | 6.3 | 2025-10-28 | A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file… |
CVE-2025-12346 | Medium | 6.3 | 2025-10-28 | A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-… |
CVE-2025-12344 | Medium | 6.3 | 2025-10-28 | A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the com… |
CVE-2025-12331 | Medium | 4.7 | 2025-10-27 | A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted… |
CVE-2025-12301 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such… |
CVE-2025-12291 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.ph… |
CVE-2025-12268 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of th… |
CVE-2025-12223 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Pa… |
CVE-2025-12222 | Medium | 6.3 | 2025-10-27 | A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2025-12201 | Medium | 4.7 | 2025-10-27 | A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the fi… |
CVE-2025-60735 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function |
CVE-2025-60731 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function |
CVE-2025-11889 | High | 7.2 | 2025-10-24 | The AIO Forms – Craft Complex Forms Easily plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import funct… |
CVE-2025-6440 | Critical | 9.8 | 2025-10-24 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file upl… |
CVE-2025-58963 | Critical | 10.0 | 2025-10-22 | Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: f… |
CVE-2025-52758 | Critical | 9.1 | 2025-10-22 | Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy zippy allows Using Malicious Files.This issue affects Zippy: from… |
CVE-2025-49060 | Critical | 10.0 | 2025-10-22 | Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wast… |
CVE-2025-48106 | Critical | 10.0 | 2025-10-22 | Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n… |
CVE-2025-60500 | High | 7.2 | 2025-10-21 | QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media up… |