CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,665 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 24 of 94

CVE-2022-28606CRITICALCVSS 9.8EG 9.8
2022-05-05
An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server.
CVE-2022-28120CRITICALCVSS 9.8EG 9.8
2022-05-05
Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server.
CVE-2022-29347CRITICALCVSS 9.8EG 9.8
2022-05-04
An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.
CVE-2022-28568CRITICALCVSS 9.8EG 9.8
2022-05-04
Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored.
CVE-2021-43934CRITICALCVSS 9.8EG 9.8
2022-04-28
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
CVE-2021-41921CRITICALCVSS 9.8EG 9.8
2022-04-28
novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution.
CVE-2022-27468CRITICALCVSS 9.8EG 9.8
2022-04-26
Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file uploaded to the web server.
CVE-2022-28021CRITICALCVSS 9.8EG 9.8
2022-04-21
Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=user.
CVE-2022-27862CRITICALCVSS 9.8EG 9.8
2022-04-19
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.
CVE-2022-28397CRITICALCVSS 9.8EG 9.8
2022-04-12
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploa…
CVE-2022-27952CRITICALCVSS 9.8EG 9.8
2022-04-12
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
CVE-2022-27263CRITICALCVSS 9.8EG 9.8
2022-04-12
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-27262CRITICALCVSS 9.8EG 9.8
2022-04-12
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-27260CRITICALCVSS 9.8EG 9.8
2022-04-12
An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
CVE-2022-27140CRITICALCVSS 9.8EG 9.8
2022-04-12
An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "…
CVE-2022-27139CRITICALCVSS 9.8EG 9.8
2022-04-12
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is …
CVE-2022-27115CRITICALCVSS 9.8EG 9.8
2022-04-11
In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.
CVE-2022-27477CRITICALCVSS 9.8EG 9.8
2022-04-10
Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.
CVE-2022-27131CRITICALCVSS 9.8EG 9.8
2022-04-10
An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27129CRITICALCVSS 9.8EG 9.8
2022-04-10
An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27047CRITICALCVSS 9.8EG 9.8
2022-04-08
mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation.
CVE-2022-27357CRITICALCVSS 9.8EG 9.8
2022-04-08
Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27351CRITICALCVSS 9.8EG 9.8
2022-04-08
Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2021-43421CRITICALCVSS 9.8EG 9.8
2022-04-07
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
CVE-2021-28428CRITICALCVSS 9.8EG 9.8
2022-04-05
File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functionality. The original file upload vulnerability (CVE-2020-27387) was remediated by restricting the …
CVE-2022-24136CRITICALCVSS 9.8EG 9.8
2022-03-31
Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can upload any PHP file, and then execute it.
CVE-2022-26645CRITICALCVSS 9.8EG 9.8
2022-03-30
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
CVE-2021-45865CRITICALCVSS 9.8EG 9.8
2022-03-29
A File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via the file upload functionality.
CVE-2022-23880CRITICALCVSS 9.8EG 9.8
2022-03-23
An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-0888CRITICALCVSS 9.8EG 9.8
2022-03-23
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it poss…
CVE-2021-27428CRITICALCVSS 9.8EG 9.8
2022-03-23
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IE…
CVE-2021-39384CRITICALCVSS 9.8EG 9.8
2022-03-20
DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java.
CVE-2021-45835CRITICALCVSS 9.8EG 9.8
2022-03-18
The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution.
CVE-2021-45834CRITICALCVSS 9.8EG 9.8
2022-03-18
An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed within the product's environment or lead to arbitrary code execution.
CVE-2021-45040CRITICALCVSS 9.8EG 9.8
2022-03-17
The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.
CVE-2022-25495CRITICALCVSS 9.8EG 9.8
2022-03-15
The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file.
CVE-2022-25487CRITICALCVSS 9.8EG 9.8
2022-03-15
Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
CVE-2021-25003CRITICALCVSS 9.8EG 9.8
2022-03-14
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
CVE-2022-24652CRITICALCVSS 9.8EG 9.8
2022-03-10
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/upload/upload.
CVE-2022-24651CRITICALCVSS 9.8EG 9.8
2022-03-10
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /user/upload/upload.
CVE-2022-25016CRITICALCVSS 9.8EG 9.8
2022-03-02
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP…
CVE-2022-25411CRITICALCVSS 9.8EG 9.8
2022-02-28
A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-24553CRITICALCVSS 9.8EG 9.8
2022-02-21
An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution.
CVE-2021-46036CRITICALCVSS 9.8EG 9.8
2022-02-18
An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVE-2022-24984CRITICALCVSS 9.8EG 9.8
2022-02-16
Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur…
CVE-2022-23390CRITICALCVSS 9.8EG 9.8
2022-02-14
An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.
CVE-2021-22803CRITICALCVSS 9.8EG 9.8
2022-02-11
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders in context of the DC module, by sending…
CVE-2020-13675CRITICALCVSS 9.8EG 9.8
2022-02-11
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass th…
CVE-2022-23329CRITICALCVSS 9.8EG 9.8
2022-02-04
A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files.
CVE-2021-46428CRITICALCVSS 9.8EG 9.8
2022-01-27
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avatar parameter in SystemSettings.php.

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →