CWE-434— Unrestricted Upload of File with Dangerous Type

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

Linear eMerge E3-Series devices allow Unrestricted File Upload.

Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.

BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmware Versions 1.3.2 and 1.6.1, Additionally, the following products using software…

Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An…

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be access…

Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.

Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.

Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.

Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.

Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.

An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforamationfileupload function, due to the lack of proper file type validation controls, resulting in a…

Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. This issue affects Lockcell: before 15.

Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command Injection, Using Malicious Files, Upload a Web Shell to a Web Server. This issue …

Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to store malicious files on the server, which could override sensitive and useful exis…

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without re…

Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.

Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.

Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.

Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.

Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.

Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.

Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5.

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE ## Summary `FacturaScripts\Core\UploadedFile::move($destiny, $destinyName)` concatenates `$dest…

Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.

Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.

Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.

Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.

Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.

Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions.

Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.

Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.