CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,571 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 71 of 92

CVE-2022-33166HIGHCVSS 7.2EG 7.2
2023-06-15
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 228586.
CVE-2023-33569HIGHCVSS 7.2EG 7.2
2023-06-06
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update_user.
CVE-2023-32628HIGHCVSS 7.2EG 7.2
2023-06-06
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code exec…
CVE-2023-22450HIGHCVSS 7.2EG 7.2
2023-06-06
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code exec…
CVE-2021-28998HIGHCVSS 7.2EG 7.2
2023-05-08
File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file.
CVE-2023-0924HIGHCVSS 7.2EG 7.2
2023-05-02
The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is d…
CVE-2022-25277HIGHCVSS 7.2EG 7.2
2023-04-26
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However,…
CVE-2022-36769HIGHCVSS 7.2EG 7.2
2023-04-26
IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034.
CVE-2023-1731HIGHCVSS 7.2EG 7.2
2023-04-24
In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands.
CVE-2023-26852HIGHCVSS 7.2EG 7.2
2023-04-12
An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file.
CVE-2023-0670HIGHCVSS 7.2EG 7.2
2023-04-05
Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the application does not va…
CVE-2023-26857HIGHCVSS 7.2EG 7.2
2023-04-05
An arbitrary file upload vulnerability in /admin/ajax.php?action=save_uploads of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2021-3267HIGHCVSS 7.2EG 7.2
2023-04-04
File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function.
CVE-2023-26830HIGHCVSS 7.2EG 7.2
2023-03-31
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by uploading malicious files to the server.
CVE-2023-25828HIGHCVSS 7.2EG 7.2
2023-03-27
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the u…
CVE-2023-27235HIGHCVSS 7.2EG 7.2
2023-03-15
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.
CVE-2023-24249HIGHCVSS 7.2EG 7.2
2023-02-27
An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2021-35290HIGHCVSS 7.2EG 7.2
2023-02-24
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page.
CVE-2023-23135HIGHCVSS 7.2EG 7.2
2023-02-01
An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.
CVE-2021-41231HIGHCVSS 7.2EG 7.2
2023-01-27
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 1…
CVE-2023-22851HIGHCVSS 7.2EG 7.2
2023-01-14
Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call.
CVE-2022-3416HIGHCVSS 7.2EG 7.2
2023-01-09
The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multis…
CVE-2022-44036HIGHCVSS 7.2EG 7.2
2023-01-03
In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execution. NOTE: the vendor's position is that this is "very obviously a feature not an issue a…
CVE-2022-45427HIGHCVSS 7.2EG 7.2
2022-12-27
Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can upload arbitrary files.
CVE-2022-45275HIGHCVSS 7.2EG 7.2
2022-12-12
An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-45009HIGHCVSS 7.2EG 7.2
2022-12-07
Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted…
CVE-2022-45912HIGHCVSS 7.2EG 7.2
2022-12-05
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, a…
CVE-2022-1540HIGHCVSS 7.2EG 7.2
2022-12-05
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
CVE-2022-45039HIGHCVSS 7.2EG 7.2
2022-11-25
An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-30529HIGHCVSS 7.2EG 7.2
2022-11-22
File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/applicati…
CVE-2022-43146HIGHCVSS 7.2EG 7.2
2022-11-14
An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-43277HIGHCVSS 7.2EG 7.2
2022-11-09
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ip/youthappam/php_action/editFile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-43050HIGHCVSS 7.2EG 7.2
2022-11-07
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-43061HIGHCVSS 7.2EG 7.2
2022-11-03
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP fil…
CVE-2022-43085HIGHCVSS 7.2EG 7.2
2022-11-01
An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-43083HIGHCVSS 7.2EG 7.2
2022-11-01
An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-43231HIGHCVSS 7.2EG 7.2
2022-10-28
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_website.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-43275HIGHCVSS 7.2EG 7.2
2022-10-28
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-39978HIGHCVSS 7.2EG 7.2
2022-10-27
Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded…
CVE-2022-39977HIGHCVSS 7.2EG 7.2
2022-10-27
Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through…
CVE-2022-42189HIGHCVSS 7.2EG 7.2
2022-10-21
Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.
CVE-2022-42201HIGHCVSS 7.2EG 7.2
2022-10-20
Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
CVE-2022-31366HIGHCVSS 7.2EG 7.2
2022-10-20
An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file.
CVE-2022-41537HIGHCVSS 7.2EG 7.2
2022-10-18
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user_operations/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP …
CVE-2022-41504HIGHCVSS 7.2EG 7.2
2022-10-18
An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-41534HIGHCVSS 7.2EG 7.2
2022-10-13
Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP fi…
CVE-2022-41533HIGHCVSS 7.2EG 7.2
2022-10-13
Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted P…
CVE-2022-41406HIGHCVSS 7.2EG 7.2
2022-10-12
An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-40921HIGHCVSS 7.2EG 7.2
2022-10-12
DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.
CVE-2022-41379HIGHCVSS 7.2EG 7.2
2022-10-07
An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →