CWE-646

10 CVEs classified under CWE-646. Browse by severity and year.

Top CVEs for CWE-646
CVESeverityScorePublishedSummary
CVE-2025-1889Critical9.82025-03-03picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that…
CVE-2026-45315High8.72026-05-15Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint take…
CVE-2021-34639High7.52021-08-05Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.p…
CVE-2024-52052High7.22024-11-21Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream…
CVE-2025-30662Medium6.62025-11-13Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tr…
CVE-2024-38432Medium5.52024-07-30Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File
CVE-2023-45599Medium5.52024-03-05A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote…
CVE-2026-20172Medium4.32026-05-06A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attac…
CVE-2025-41720Medium4.32025-10-22A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension…
CVE-2025-584492025-09-08Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Prod…
All CVEs classified under CWE-646 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-45315High8.72026-05-15Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint take…
CVE-2026-20172Medium4.32026-05-06A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attac…
CVE-2025-30662Medium6.62025-11-13Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tr…
CVE-2025-41720Medium4.32025-10-22A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension…
CVE-2025-584492025-09-08Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Prod…
CVE-2025-1889Critical9.82025-03-03picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that…
CVE-2024-52052High7.22024-11-21Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream…
CVE-2024-38432Medium5.52024-07-30Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File
CVE-2023-45599Medium5.52024-03-05A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote…
CVE-2021-34639High7.52021-08-05Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.p…