CWE-434— Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog
4,576 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-434page 81 of 92
- CVE-2025-10428MEDIUMCVSS 6.3EG 6.32025-09-15
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/seo_setting.php of the component Setting Handler. The manipulation of the argument websit…
- CVE-2025-10427MEDIUMCVSS 6.3EG 6.32025-09-15
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php. Executing manipulation of the argument website_image can lead to unrestricted up…
- CVE-2025-10398MEDIUMCVSS 6.3EG 6.32025-09-14
A security flaw has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the file FileUploadUtils.java. The manipulation of the argument File results in unrestricted upload. The …
- CVE-2025-10085MEDIUMCVSS 6.3EG 6.32025-09-08
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file manage_website.php. The manipulation results in unrestricted upload. It is possible to launch t…
- CVE-2025-10083MEDIUMCVSS 6.3EG 6.32025-09-08
A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/profile.php. Executing manipulation can lead to unrestricted upload. The attack …
- CVE-2025-27714MEDIUMCVSS 6.3EG 6.32025-08-21
An attacker could exploit this vulnerability by uploading arbitrary files via the a specific endpoint, leading to unauthorized remote code execution or system compromise.
- CVE-2025-24489MEDIUMCVSS 6.3EG 6.32025-08-21
An attacker could exploit this vulnerability by uploading arbitrary files via a specific service, which could lead to system compromise.
- CVE-2025-9099MEDIUMCVSS 6.3EG 6.32025-08-18
A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is p…
- CVE-2025-8174MEDIUMCVSS 6.3EG 6.32025-07-26
A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/candidates_add.php. The manipulation of the argument photo leads to unrestrict…
- CVE-2025-8171MEDIUMCVSS 6.3EG 6.32025-07-25
A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing of the file /insert.php. The manipulation of the argument uploaded_file leads to …
- CVE-2025-8128MEDIUMCVSS 6.3EG 6.32025-07-25
A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a65228476290949e0413de48f7fbe98. This issue affects some unknown processing of the file routes\bf\product.js. The manipulation of the argument…
- CVE-2025-20274MEDIUMCVSS 6.3EG 6.32025-07-16
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation o…
- CVE-2025-7487MEDIUMCVSS 6.3EG 6.32025-07-12
A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the …
- CVE-2025-5873MEDIUMCVSS 6.3EG 6.32025-06-09
A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of the component Web UI. Performing a manipulation of the argument media results in…
- CVE-2025-4768MEDIUMCVSS 6.3EG 6.32025-05-16
A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file PictureServiceImpl.java. The manipulation of the argument File leads to unrestr…
- CVE-2025-4735MEDIUMCVSS 6.3EG 6.32025-05-16
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/product.php. The manipulation of the argument Picture lead…
- CVE-2025-4538MEDIUMCVSS 6.3EG 6.32025-05-11
A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the att…
- CVE-2025-4333MEDIUMCVSS 6.3EG 6.32025-05-06
A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFile of the file src/main/java/com/megagao/production/ssm/service/impl/FileServiceI…
- CVE-2025-4305MEDIUMCVSS 6.3EG 6.32025-05-06
A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/controller/File.php. The manipulation of the argument File leads to unrestricted u…
- CVE-2025-4291MEDIUMCVSS 6.3EG 6.32025-05-05
A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been discl…
- CVE-2025-4259MEDIUMCVSS 6.3EG 6.32025-05-05
A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File …
- CVE-2025-4258MEDIUMCVSS 6.3EG 6.32025-05-05
A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master\src\main\java\com\ukefu\webim\web\handler\resource\MediaController.java. The ma…
- CVE-2025-3969MEDIUMCVSS 6.3EG 6.32025-04-27
A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-category.php of the component Edit Category Page. The manipulation of…
- CVE-2025-3830MEDIUMCVSS 6.3EG 6.32025-04-20
A vulnerability was found in kuangstudy KuangSimpleBBS 1.0. It has been declared as critical. Affected by this vulnerability is the function fileUpload of the file src/main/java/com/kuang/controller/QuestionController.java. The manipulatio…
- CVE-2025-3807MEDIUMCVSS 6.3EG 6.32025-04-19
A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/controller/common/UploadController.java of the component Endpoint. The manipulatio…
- CVE-2025-3783MEDIUMCVSS 6.3EG 6.32025-04-18
A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-product.php. The manipulation of the argument …
- CVE-2025-3765MEDIUMCVSS 6.3EG 6.32025-04-17
A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument …
- CVE-2025-3764MEDIUMCVSS 6.3EG 6.32025-04-17
A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of the file /edit-product.php. The manipulation of the argument Avatar leads to un…
- CVE-2025-3593MEDIUMCVSS 6.3EG 6.32025-04-14
A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of the file /admin/upload/authorImg/. The manipulation of the argument File leads to …
- CVE-2025-3585MEDIUMCVSS 6.3EG 6.32025-04-14
A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser. The manipulation of the argument File leads to unrestricted upload. It is possi…
- CVE-2025-3558MEDIUMCVSS 6.3EG 6.32025-04-14
A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is…
- CVE-2025-3410MEDIUMCVSS 6.3EG 6.32025-04-08
A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java. Th…
- CVE-2025-3324MEDIUMCVSS 6.3EG 6.32025-04-06
A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads …
- CVE-2025-3244MEDIUMCVSS 6.3EG 6.32025-04-04
A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add-admin.php of the component Create U…
- CVE-2025-3042MEDIUMCVSS 6.3EG 6.32025-04-01
A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. This vulnerability affects unknown code of the file /student/updateprofile.php. The manipulation of the argument pic leads to unrestricted …
- CVE-2025-3041MEDIUMCVSS 6.3EG 6.32025-04-01
A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /admin/updatestudent.php. The manipulation of the argument pic leads to unrestricted upload. …
- CVE-2025-3040MEDIUMCVSS 6.3EG 6.32025-03-31
A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_student.php. The manipulation of the argument pic leads…
- CVE-2025-2978MEDIUMCVSS 6.3EG 6.32025-03-31
A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/upload/?&CKEditor=container&CKEditorFuncNum=1 of the component Article Publishing…
- CVE-2025-2973MEDIUMCVSS 6.3EG 6.32025-03-31
A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/student.php. The manipulation of the argument profile_image leads to unrestricted …
- CVE-2025-2952MEDIUMCVSS 6.3EG 6.32025-03-30
A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.php?mod=upload&type=1. The manipulation of the argument File leads to unrestricted…
- CVE-2025-2706MEDIUMCVSS 6.3EG 6.32025-03-24
A vulnerability classified as critical was found in Digiwin ERP 5.0.1. Affected by this vulnerability is an unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx. The manipulation of the argument File leads to unrestricted uplo…
- CVE-2025-2702MEDIUMCVSS 6.3EG 6.32025-03-24
A vulnerability, which was classified as critical, has been found in Softwin WMX3 3.1. This issue affects the function ImageAdd of the file /ImageAdd.ashx. The manipulation of the argument File leads to unrestricted upload. The attack may …
- CVE-2025-2687MEDIUMCVSS 6.3EG 6.32025-03-24
A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the component Image Handler. The manipulation leads to unrestricted upload. It is poss…
- CVE-2025-2671MEDIUMCVSS 6.3EG 6.32025-03-23
A vulnerability was found in Yue Lao Blind Box 月老盲盒 up to 4.0. It has been declared as critical. This vulnerability affects the function base64image of the file /app/controller/Upload.php. The manipulation of the argument data lead…
- CVE-2025-2607MEDIUMCVSS 6.3EG 6.32025-03-21
A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/upload/upimage.html of the component HTTP POST Request Ha…
- CVE-2025-2606MEDIUMCVSS 6.3EG 6.32025-03-21
A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/soulwinning_crud.php. The manipulation of …
- CVE-2025-29405MEDIUMCVSS 6.3EG 6.32025-03-19
An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2025-2350MEDIUMCVSS 6.3EG 6.32025-03-16
A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/upload_file. The manipulation leads to unrestricted upload. Access to t…
- CVE-2025-2216MEDIUMCVSS 6.3EG 6.32025-03-12
A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function UploadCrash of the file /crash/log/SaveCrash.ashx. The manipulation of the argum…
- CVE-2025-2115MEDIUMCVSS 6.3EG 6.32025-03-09
A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 3.1. Affected is the function ProcessRequest of the file /AcceptZip.ashx. The manipulation of the argument file leads to unrestri…
Map vulnerabilities like CWE-434 to your infrastructure
EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →