CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,665 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 32 of 94

CVE-2016-7095CRITICALCVSS 9.8EG 9.8
2016-11-03
Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution.
CVE-2015-1000001CRITICALCVSS 9.8EG 9.8
2016-10-06
Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin
CVE-2015-1000000CRITICALCVSS 9.8EG 9.8
2016-10-06
Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
CVE-2016-5050CRITICALCVSS 9.8EG 9.8
2016-08-26
Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file.
CVE-2022-47615CRITICALCVSS 9.3EG 9.8
2023-01-26
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
CVE-2025-67910CRITICALCVSS 9.1EG 9.8
2026-01-08
Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.
CVE-2026-50768CRITICALCVSS 8.8EG 9.8
2026-08-17
File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.
CVE-2025-2780CRITICALCVSS 8.8EG 9.8
2025-04-04
The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it p…
CVE-2024-41339CRITICALCVSS 8.8EG 9.8
2025-02-27
An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 pri…
CVE-2024-57668CRITICALCVSS 8.8EG 9.8
2025-02-06
In Code-projects Shopping Portal v1.0, the insert-product.php page has an arbitrary file upload vulnerability.
CVE-2024-37847CRITICALCVSS 8.8EG 9.8
2024-10-25
An arbitrary file upload vulnerability in MangoOS before 5.1.4 and Mango API before 4.5.5 allows attackers to execute arbitrary code via a crafted file.
CVE-2023-6979CRITICALCVSS 8.8EG 9.8
2024-01-11
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to, and including, 5.38.9. This makes it po…
CVE-2021-26642CRITICALCVSS 8.8EG 9.8
2023-01-20
When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute …
CVE-2015-3884CRITICALCVSS 8.8EG 9.8
2017-03-17
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with…
CVE-2022-33859CRITICALCVSS 8.1EG 9.8
2022-10-28
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures…
CVE-2023-1800CRITICALCVSS 7.3EG 9.8
2023-04-02
A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to p…
CVE-2023-1734CRITICALCVSS 7.3EG 9.8
2023-03-30
A vulnerability classified as critical has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected is an unknown function of the file admin/products/controller.php?action=add. The manipulation of the argument image l…
CVE-2022-4273CRITICALCVSS 7.3EG 9.8
2022-12-03
A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Han…
CVE-2022-2647CRITICALCVSS 7.3EG 9.8
2022-08-04
A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely.…
CVE-2022-46135CRITICALCVSS 7.2EG 9.8
2022-12-16
In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which we can upload webshell and control the web server.
CVE-2021-42171CRITICALCVSS 7.2EG 9.8
2022-03-14
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local v…
CVE-2019-12326CRITICALCVSS 7.2EG 9.8
2019-07-22
Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload (shell commands within the file) and trigger cod…
CVE-2017-20021CRITICALCVSS 6.5EG 9.8
2022-06-09
A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85. This affects an unknown part of the component File Upload. The manipulation leads to privilege escalation. It is possible to initiate the a…
CVE-2011-4183CRITICALCVSS 6.5EG 9.8
2018-06-13
A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.
CVE-2018-2420CRITICALCVSS 6.5EG 9.8
2018-05-09
SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file (including script files) without proper file format validation.
CVE-2024-6439CRITICALCVSS 6.3EG 9.8
2024-07-02
A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img lea…
CVE-2023-1942CRITICALCVSS 6.3EG 9.8
2023-04-07
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/?page=user of the component Avatar Handler. The…
CVE-2023-1826CRITICALCVSS 6.3EG 9.8
2023-04-04
A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file php-ocls\admin\system_info\index.php. The manipulation of the argument img leads …
CVE-2023-1797CRITICALCVSS 6.3EG 9.8
2023-04-02
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched re…
CVE-2023-1739CRITICALCVSS 6.3EG 9.8
2023-03-30
A vulnerability was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0 and classified as critical. This issue affects some unknown processing of the file upload.php. The manipulation leads to unrestricted upload. The att…
CVE-2023-1561CRITICALCVSS 6.3EG 9.8
2023-03-22
A vulnerability, which was classified as critical, was found in code-projects Simple Online Hotel Reservation System 1.0. Affected is an unknown function of the file add_room.php. The manipulation leads to unrestricted upload. It is possib…
CVE-2023-1558CRITICALCVSS 6.3EG 9.8
2023-03-22
A vulnerability classified as critical has been found in Simple and Beautiful Shopping Cart System 1.0. This affects an unknown part of the file uploadera.php. The manipulation leads to unrestricted upload. It is possible to initiate the a…
CVE-2023-1497CRITICALCVSS 6.3EG 9.8
2023-03-19
A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. It has been rated as critical. This issue affects some unknown processing of the file uploaderm.php. The manipulation of the argument submit leads to unr…
CVE-2023-1484CRITICALCVSS 6.3EG 9.8
2023-03-18
A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be …
CVE-2023-1479CRITICALCVSS 6.3EG 9.8
2023-03-18
A vulnerability classified as critical has been found in SourceCodester Simple Music Player 1.0. Affected is an unknown function of the file save_music.php. The manipulation of the argument filename leads to unrestricted upload. It is poss…
CVE-2023-1392CRITICALCVSS 6.3EG 9.8
2023-03-14
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is the function save_menu. The manipulation leads to unrestricted upload. The attack can be launch…
CVE-2023-1303CRITICALCVSS 6.3EG 9.8
2023-03-09
A vulnerability was found in UCMS 1.6 and classified as critical. This issue affects some unknown processing of the file sadmin/fileedit.php of the component System File Management Module. The manipulation of the argument file leads to unr…
CVE-2023-0918CRITICALCVSS 6.3EG 9.8
2023-02-19
A vulnerability has been found in codeprojects Pharmacy Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file add.php of the component Avatar Image Handler. The manipulation leads to unrestri…
CVE-2023-0651CRITICALCVSS 6.3EG 9.8
2023-02-02
A vulnerability was found in FastCMS 0.1.0. It has been classified as critical. Affected is an unknown function of the component Template Management. The manipulation leads to unrestricted upload. It is possible to launch the attack remote…
CVE-2022-4276CRITICALCVSS 6.3EG 9.8
2022-12-03
A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_phot…
CVE-2022-4272CRITICALCVSS 6.3EG 9.8
2022-12-03
A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestr…
CVE-2022-3771CRITICALCVSS 6.3EG 9.8
2022-10-31
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. Th…
CVE-2022-3458CRITICALCVSS 6.3EG 9.8
2022-10-12
A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /employeeview.php of the component Image File Handler.…
CVE-2022-3129CRITICALCVSS 6.3EG 9.8
2022-09-07
A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registration.php. The manipulation leads to unrestricted upload. The attack m…
CVE-2022-2804CRITICALCVSS 6.3EG 9.8
2022-08-12
A vulnerability was found in SourceCodester Zoo Management System. It has been classified as critical. Affected is an unknown function of the file /pages/apply_vacancy.php. The manipulation of the argument filename leads to unrestricted up…
CVE-2022-2779CRITICALCVSS 6.3EG 9.8
2022-08-12
A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument …
CVE-2022-2751CRITICALCVSS 6.3EG 9.8
2022-08-11
A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/add-portfolio.php. The manipulation of the argument ufile leads to unre…
CVE-2022-2750CRITICALCVSS 6.3EG 9.8
2022-08-11
A vulnerability, which was classified as critical, was found in SourceCodester Company Website CMS. Affected is an unknown function of the file /dashboard/add-service.php of the component Add Service Handler. The manipulation leads to unre…
CVE-2022-2746CRITICALCVSS 6.3EG 9.8
2022-08-11
A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. This vulnerability affects unknown code of the file Admin_ add.php. The manipulation leads to unrestricted upload. The attack can …
CVE-2022-2744CRITICALCVSS 6.3EG 9.8
2022-08-11
A vulnerability, which was classified as critical, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality of the file /admin/add_exercises.php of the component Background Management. Th…

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →