CWE-434 · Unrestricted Upload of File with Dangerous Type (page 9)
Page 9 of 43 — CVEs classified under CWE-434, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-60500 | High | 7.2 | 2025-10-21 | QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media up… |
CVE-2025-61181 | Medium | 6.5 | 2025-10-21 | daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature. |
CVE-2025-61417 | High | 8.8 | 2025-10-20 | Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file… |
CVE-2025-31342 | | 2025-10-20 | An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module th… | |
CVE-2025-11948 | Critical | 9.8 | 2025-10-20 | Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and e… |
CVE-2025-11391 | Critical | 9.8 | 2025-10-18 | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in t… |
CVE-2025-56218 | Critical | 9.8 | 2025-10-17 | An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file. |
CVE-2025-11908 | Medium | 6.3 | 2025-10-17 | A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir… |
CVE-2023-28814 | Critical | 9.8 | 2025-10-17 | Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded… |
CVE-2025-10754 | High | 7.2 | 2025-10-15 | The DocoDoco Store Locator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in… |
CVE-2025-10051 | High | 7.2 | 2025-10-15 | The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1… |
CVE-2025-10041 | Critical | 9.8 | 2025-10-15 | The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function… |
CVE-2023-7305 | | 2025-10-15 | SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configurations or usage patt… | |
CVE-2025-61678 | | 2025-10-14 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17… | |
CVE-2025-37132 | High | 7.2 | 2025-10-14 | An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating syst… |
CVE-2025-42910 | Critical | 9.0 | 2025-10-14 | Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These fil… |
CVE-2025-11675 | High | 7.2 | 2025-10-13 | Enterprise Cloud Database developed by Ragic has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell b… |
CVE-2025-11660 | High | 7.3 | 2025-10-13 | A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some u… |
CVE-2025-11659 | High | 7.3 | 2025-10-13 | A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unkn… |
CVE-2025-11658 | High | 7.3 | 2025-10-13 | A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of… |
CVE-2025-11657 | High | 7.3 | 2025-10-13 | A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unkn… |
CVE-2025-11656 | High | 7.3 | 2025-10-13 | A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function… |
CVE-2025-11655 | Medium | 4.7 | 2025-10-13 | A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the compone… |
CVE-2025-6553 | Critical | 9.8 | 2025-10-11 | The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function… |
CVE-2025-35055 | High | 8.8 | 2025-10-09 | Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the… |
CVE-2025-11508 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in code-projects Voting System 1.0. This affects an unknown function of the file /admin/voters_add.php. Such manipul… |
CVE-2025-11470 | Medium | 4.7 | 2025-10-08 | A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the fi… |
CVE-2025-11436 | Medium | 6.3 | 2025-10-08 | A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results… |
CVE-2025-11426 | Medium | 6.3 | 2025-10-08 | A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-11417 | Medium | 6.3 | 2025-10-08 | A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This vulnerability affects unknown code of the file /admin/voters_add… |
CVE-2025-11398 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the file /profile.php of… |
CVE-2025-11354 | Medium | 6.3 | 2025-10-07 | A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing mani… |
CVE-2025-11353 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Perf… |
CVE-2025-11352 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.ph… |
CVE-2025-11351 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec… |
CVE-2025-11347 | High | 7.3 | 2025-10-07 | A vulnerability was found in code-projects Student Crud Operation up to 3.3. This vulnerability affects the function move_uploaded_file of the file add.php of… |
CVE-2025-61768 | | 2025-10-06 | KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Medi… | |
CVE-2025-61687 | High | 8.3 | 2025-10-06 | Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authe… |
CVE-2025-11320 | Medium | 6.3 | 2025-10-06 | A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/… |
CVE-2025-11318 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file u… |
CVE-2025-61681 | Medium | 5.4 | 2025-10-03 | KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exp… |
CVE-2025-9561 | High | 8.8 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation within the advPara… |
CVE-2025-9212 | High | 7.5 | 2025-10-03 | The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() functi… |
CVE-2025-59835 | | 2025-10-02 | LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/docu… | |
CVE-2025-11221 | High | 8.8 | 2025-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFl… |
CVE-2025-11020 | High | 8.8 | 2025-10-02 | An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with… |
CVE-2025-56515 | High | 8.8 | 2025-10-01 | File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowin… |
CVE-2025-8120 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type… |
CVE-2025-7065 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type… |
CVE-2025-7063 | Critical | 9.8 | 2025-09-30 | Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type… |
CVE-2025-10000 | Medium | 6.4 | 2025-09-30 | The Qyrr – simply and modern QR-Code creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the blob_to_f… |
CVE-2025-34222 | Critical | 9.1 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose… |
CVE-2025-35032 | Low | 3.4 | 2025-09-29 | Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are ac… |
CVE-2025-11136 | Medium | 4.7 | 2025-09-29 | A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Back… |
CVE-2025-11103 | Medium | 4.7 | 2025-09-28 | A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-11078 | Medium | 6.3 | 2025-09-27 | A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/c… |
CVE-2025-10544 | | 2025-09-26 | Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upl… | |
CVE-2025-60219 | Critical | 10.0 | 2025-09-26 | Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.T… |
CVE-2025-1862 | Medium | 6.7 | 2025-09-26 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service… |
CVE-2025-10747 | High | 7.2 | 2025-09-26 | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all ver… |
CVE-2025-59525 | Medium | 6.1 | 2025-09-24 | Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, improper sanitization across the application allows XSS via… |
CVE-2025-59524 | Medium | 6.1 | 2025-09-24 | Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, the file upload flow performs validation only in the browser… |
CVE-2025-9846 | Critical | 10.0 | 2025-09-23 | Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. … |
CVE-2025-10412 | Critical | 9.8 | 2025-09-23 | The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misc… |
CVE-2025-10147 | Critical | 9.8 | 2025-09-23 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' f… |
CVE-2025-10009 | | 2025-09-22 | Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary c… | |
CVE-2025-10763 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality… |
CVE-2025-10755 | Medium | 6.3 | 2025-09-20 | A vulnerability was detected in Selleo Mentingo 2025.08.27. The impacted element is an unknown function of the component Content-Type Handler. The manipulation… |
CVE-2025-10741 | Medium | 6.3 | 2025-09-20 | A security vulnerability has been detected in Selleo Mentingo up to 2025.08.27. The affected element is an unknown function of the component Profile Picture Ha… |
CVE-2025-34195 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (Windows client deployments) contain a… |
CVE-2025-10647 | High | 8.8 | 2025-09-19 | The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_med… |
CVE-2025-55912 | High | 7.3 | 2025-09-18 | An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary… |
CVE-2025-10669 | Medium | 6.3 | 2025-09-18 | A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Handler. Performing ma… |
CVE-2025-40678 | | 2025-09-18 | Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerou… | |
CVE-2025-10616 | Medium | 6.3 | 2025-09-17 | A security flaw has been discovered in itsourcecode E-Commerce Website 1.0. Affected is an unknown function of the file /admin/users.php. The manipulation resu… |
CVE-2025-10615 | Medium | 6.3 | 2025-09-17 | A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads… |
CVE-2025-10600 | High | 7.3 | 2025-09-17 | A flaw has been found in SourceCodester Online Exam Form Submission 1.0. This impacts an unknown function of the file /register.php. This manipulation of the a… |
CVE-2025-9216 | High | 8.8 | 2025-09-17 | The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file… |
CVE-2025-56263 | High | 8.8 | 2025-09-16 | by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of… |
CVE-2025-56295 | High | 7.3 | 2025-09-16 | code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor files when modifying p… |
CVE-2009-20006 | | 2025-09-16 | osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface all… | |
CVE-2025-10480 | Medium | 6.3 | 2025-09-15 | A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /save_file.php. Execut… |
CVE-2025-57176 | Medium | 6.5 | 2025-09-15 | On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unaut… |
CVE-2025-10447 | High | 7.3 | 2025-09-15 | A vulnerability was detected in Campcodes Online Job Finder System 1.0. The impacted element is an unknown function of the file /eris/applicationform.php. The… |
CVE-2025-10428 | Medium | 6.3 | 2025-09-15 | A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/seo_setti… |
CVE-2025-10427 | Medium | 6.3 | 2025-09-15 | A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php… |
CVE-2025-10425 | High | 7.3 | 2025-09-15 | A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function… |
CVE-2025-10424 | High | 7.3 | 2025-09-15 | A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function… |
CVE-2025-10398 | Medium | 6.3 | 2025-09-14 | A security flaw has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils… |
CVE-2025-10371 | High | 7.3 | 2025-09-13 | A security flaw has been discovered in eCharge Hardy Barth Salia PLCC up to 2.3.81. This issue affects some unknown processing of the file /api.php. The manipu… |
CVE-2025-45586 | High | 7.5 | 2025-09-12 | An issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite files via supplying a crafted PUT request. |
CVE-2025-55835 | Critical | 9.8 | 2025-09-12 | File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering. |
CVE-2025-57642 | High | 7.2 | 2025-09-10 | A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to re… |
CVE-2025-10049 | High | 7.2 | 2025-09-10 | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_… |
CVE-2025-10001 | High | 7.2 | 2025-09-10 | The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the impo… |
CVE-2025-9872 | High | 8.8 | 2025-09-09 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote cod… |
CVE-2025-9712 | High | 8.8 | 2025-09-09 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote cod… |
CVE-2025-8889 | Low | 3.8 | 2025-09-09 | The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary… |
CVE-2025-10116 | High | 7.3 | 2025-09-09 | A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. Such manipulation le… |
CVE-2025-58745 | Critical | 9.9 | 2025-09-08 | WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary file upload vulnerability. The WeGIA o… |