CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,665 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 29 of 94

CVE-2019-15936CRITICALCVSS 9.8EG 9.8
2019-12-12
Intesync Solismed 3.3sp allows Insecure File Upload.
CVE-2019-19595CRITICALCVSS 9.8EG 9.8
2019-12-05
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by uploading a .php file.
CVE-2019-19594CRITICALCVSS 9.8EG 9.8
2019-12-05
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a .php file.
CVE-2019-19576CRITICALCVSS 9.8EG 9.8
2019-12-04
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
CVE-2019-12409CRITICALCVSS 9.8EG 9.8
2019-11-18
The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the af…
CVE-2019-12271CRITICALCVSS 9.8EG 9.8
2019-11-18
Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is not enforced on the server side.
CVE-2019-18952CRITICALCVSS 9.8EG 9.8
2019-11-13
SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951 to achieve remote code execution via a .html file, containing short codes, that is served over HTTP.
CVE-2019-12719CRITICALCVSS 9.8EG 9.8
2019-11-12
An issue was discovered in Picture_Manage_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority par…
CVE-2011-1134CRITICALCVSS 9.8EG 9.8
2019-11-05
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager.
CVE-2019-14451CRITICALCVSS 9.8EG 9.8
2019-10-25
RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external co…
CVE-2015-9499CRITICALCVSS 9.8EG 9.8
2019-10-22
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.
CVE-2019-16700CRITICALCVSS 9.8EG 9.8
2019-10-16
The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this …
CVE-2015-9479CRITICALCVSS 9.8EG 9.8
2019-10-10
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
CVE-2015-9471CRITICALCVSS 9.8EG 9.8
2019-10-10
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
CVE-2018-21024CRITICALCVSS 9.8EG 9.8
2019-10-08
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.
CVE-2019-15751CRITICALCVSS 9.8EG 9.8
2019-10-07
An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious fil…
CVE-2019-15748CRITICALCVSS 9.8EG 9.8
2019-10-07
SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM packa…
CVE-2016-10995CRITICALCVSS 9.8EG 9.8
2019-09-18
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
CVE-2019-15131CRITICALCVSS 9.8EG 9.8
2019-09-17
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create d…
CVE-2016-10955CRITICALCVSS 9.8EG 9.8
2019-09-13
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
CVE-2016-10954CRITICALCVSS 9.8EG 9.8
2019-09-13
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
CVE-2019-16192CRITICALCVSS 9.8EG 9.8
2019-09-09
upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.
CVE-2019-13187CRITICALCVSS 9.8EG 9.8
2019-09-05
The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php.
CVE-2019-13976CRITICALCVSS 9.8EG 9.8
2019-09-04
eGain Chat 15.0.3 allows unrestricted file upload.
CVE-2019-15524CRITICALCVSS 9.8EG 9.8
2019-08-26
CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI.
CVE-2019-11031CRITICALCVSS 9.8EG 9.8
2019-08-22
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges.
CVE-2019-15130CRITICALCVSS 9.8EG 9.8
2019-08-18
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm mult…
CVE-2019-15091CRITICALCVSS 9.8EG 9.8
2019-08-16
filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload.
CVE-2019-13973CRITICALCVSS 9.8EG 9.8
2019-07-19
LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used.
CVE-2019-1010062CRITICALCVSS 9.8EG 9.8
2019-07-16
PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to up…
CVE-2019-12803CRITICALCVSS 9.8EG 9.8
2019-07-10
In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, the specific upload web module doesn't verify the file extension and type, and an attacker can upload a webshell. After the webshell upload, an attacker can use the webshell t…
CVE-2019-12971CRITICALCVSS 9.8EG 9.8
2019-07-05
BKS EBK Ethernet-Buskoppler Pro before 3.01 allows Unrestricted Upload of a File with a Dangerous Type.
CVE-2019-13294CRITICALCVSS 9.8EG 9.8
2019-07-04
AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system.
CVE-2019-7274CRITICALCVSS 9.8EG 9.8
2019-07-01
Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root.
CVE-2019-13082CRITICALCVSS 9.8EG 9.8
2019-06-30
Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and once it has been extracted, does not check files in a recursiv…
CVE-2019-7838CRITICALCVSS 9.8EG 9.8
2019-06-12
ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-9642CRITICALCVSS 9.8EG 9.8
2019-06-05
An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created…
CVE-2019-11185CRITICALCVSS 9.8EG 9.8
2019-06-03
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted execut…
CVE-2019-12377CRITICALCVSS 9.8EG 9.8
2019-06-03
A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary remote code execution.
CVE-2019-7816CRITICALCVSS 9.8EG 9.8
2019-05-24
ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2016-10752CRITICALCVSS 9.8EG 9.8
2019-05-24
serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
CVE-2019-12150CRITICALCVSS 9.8EG 9.8
2019-05-24
Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted). The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under …
CVE-2019-11887CRITICALCVSS 9.8EG 9.8
2019-05-17
SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution.
CVE-2019-9951CRITICALCVSS 9.8EG 9.8
2019-04-24
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upl…
CVE-2019-11344CRITICALCVSS 9.8EG 9.8
2019-04-19
data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked.
CVE-2019-11223CRITICALCVSS 9.8EG 9.8
2019-04-18
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
CVE-2019-3940CRITICALCVSS 9.8EG 9.8
2019-04-09
Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to execute arbitrary code.
CVE-2019-10647CRITICALCVSS 9.8EG 9.8
2019-03-30
ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, sourc…
CVE-2019-10276CRITICALCVSS 9.8EG 9.8
2019-03-29
Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type.
CVE-2018-20526CRITICALCVSS 9.8EG 9.8
2019-03-21
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →