CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,665 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 20 of 94

CVE-2023-4186CRITICALCVSS 9.8EG 9.8
2023-08-06
A vulnerability was found in SourceCodester Pharmacy Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file manage_website.php. The manipulation leads to unrestricted…
CVE-2023-4121CRITICALCVSS 9.8EG 9.8
2023-08-03
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument file_upload leads to unrestricted upload. It is possib…
CVE-2023-33493CRITICALCVSS 9.8EG 9.8
2023-08-01
An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for PrestaShop through 2.3.0, allows remote attackers to upload dangerous files without restrictions.
CVE-2023-32225CRITICALCVSS 9.8EG 9.8
2023-07-30
Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method.
CVE-2023-37677CRITICALCVSS 9.8EG 9.8
2023-07-25
Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.php.
CVE-2023-34798CRITICALCVSS 9.8EG 9.8
2023-07-25
An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2023-32637CRITICALCVSS 9.8EG 9.8
2023-07-25
GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyone who can upload files through the product may execute arbitrary code on the server.
CVE-2023-37289CRITICALCVSS 9.8EG 9.8
2023-07-20
It is identified a vulnerability of Unrestricted Upload of File with Dangerous Type in the file uploading function in InfoDoc Document On-line Submission and Approval System, which allows an unauthenticated remote attacker can exploit thi…
CVE-2023-37839CRITICALCVSS 9.8EG 9.8
2023-07-13
An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-34136CRITICALCVSS 9.8EG 9.8
2023-07-13
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier…
CVE-2023-37629CRITICALCVSS 9.8EG 9.8
2023-07-12
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php."
CVE-2023-37656CRITICALCVSS 9.8EG 9.8
2023-07-11
WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.
CVE-2023-37152CRITICALCVSS 9.8EG 9.8
2023-07-10
Projectworlds Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. Note: This has been disputed as not a valid vulnerability.
CVE-2020-22153CRITICALCVSS 9.8EG 9.8
2023-07-03
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
CVE-2020-22151CRITICALCVSS 9.8EG 9.8
2023-07-03
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
CVE-2020-18432CRITICALCVSS 9.8EG 9.8
2023-06-30
File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges.
CVE-2023-34738CRITICALCVSS 9.8EG 9.8
2023-06-29
Chemex through 3.7.1 is vulnerable to arbitrary file upload.
CVE-2022-44276CRITICALCVSS 9.8EG 9.8
2023-06-28
In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
CVE-2023-2068CRITICALCVSS 9.8EG 9.8
2023-06-27
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not includ…
CVE-2023-33404CRITICALCVSS 9.8EG 9.8
2023-06-26
An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.
CVE-2023-36097CRITICALCVSS 9.8EG 9.8
2023-06-22
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
CVE-2020-21489CRITICALCVSS 9.8EG 9.8
2023-06-20
File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.
CVE-2020-21474CRITICALCVSS 9.8EG 9.8
2023-06-20
File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter.
CVE-2020-21174CRITICALCVSS 9.8EG 9.8
2023-06-20
File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
CVE-2020-20735CRITICALCVSS 9.8EG 9.8
2023-06-20
File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter.
CVE-2020-20718CRITICALCVSS 9.8EG 9.8
2023-06-20
File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file() parameter.
CVE-2023-32753CRITICALCVSS 9.8EG 9.8
2023-06-16
OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system comman…
CVE-2023-32752CRITICALCVSS 9.8EG 9.8
2023-06-16
L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable…
CVE-2023-34747CRITICALCVSS 9.8EG 9.8
2023-06-14
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
CVE-2023-34944CRITICALCVSS 9.8EG 9.8
2023-06-13
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
CVE-2023-31541CRITICALCVSS 9.8EG 9.8
2023-06-13
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
CVE-2020-36705CRITICALCVSS 9.8EG 9.8
2023-06-07
The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated …
CVE-2019-25138CRITICALCVSS 9.8EG 9.8
2023-06-07
The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312. This makes it possible for unauthenticat…
CVE-2016-15033CRITICALCVSS 9.8EG 9.8
2023-06-07
The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthen…
CVE-2023-29631CRITICALCVSS 9.8EG 9.8
2023-06-05
PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.
CVE-2023-33386CRITICALCVSS 9.8EG 9.8
2023-06-05
MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.
CVE-2023-33508CRITICALCVSS 9.8EG 9.8
2023-05-31
KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).
CVE-2023-29721CRITICALCVSS 9.8EG 9.8
2023-05-24
SofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution.
CVE-2023-28409CRITICALCVSS 9.8EG 9.8
2023-05-23
Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated attacker to upload an arbitrary file.
CVE-2023-27397CRITICALCVSS 9.8EG 9.8
2023-05-23
Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. If the product's file upload function and server save option are enabled, a remote attacker may save an arbitrary file on the server and…
CVE-2023-31689CRITICALCVSS 9.8EG 9.8
2023-05-22
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and up…
CVE-2023-30333CRITICALCVSS 9.8EG 9.8
2023-05-18
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.
CVE-2023-31903CRITICALCVSS 9.8EG 9.8
2023-05-17
GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.
CVE-2023-31857CRITICALCVSS 9.8EG 9.8
2023-05-16
Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save.
CVE-2022-4774CRITICALCVSS 9.8EG 9.8
2023-05-15
The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote C…
CVE-2023-30247CRITICALCVSS 9.8EG 9.8
2023-05-12
File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the update_settings parameter.
CVE-2023-30185CRITICALCVSS 9.8EG 9.8
2023-05-08
CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.
CVE-2023-30090CRITICALCVSS 9.8EG 9.8
2023-05-05
Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-30122CRITICALCVSS 9.8EG 9.8
2023-05-05
An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-30264CRITICALCVSS 9.8EG 9.8
2023-05-04
CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via application/admin/controller/Template.php:update.

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →