CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,576 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 82 of 92

CVE-2025-2035MEDIUMCVSS 6.3EG 6.3
2025-03-06
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /customer_register.php. The manipulation of the argument name leads to unrest…
CVE-2025-2031MEDIUMCVSS 6.3EG 6.3
2025-03-06
A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. The manipulation of the argument file leads to unrestricted upload. It is possible…
CVE-2025-1890MEDIUMCVSS 6.3EG 6.3
2025-03-04
A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. The manipulation of the arg…
CVE-2025-1835MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability has been found in osuuu LightPicture 1.2.2 and classified as critical. This vulnerability affects the function upload of the file /app/controller/Api.php. The manipulation of the argument file leads to unrestricted upload. …
CVE-2025-1834MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability, which was classified as critical, was found in zj1983 zz up to 2024-8. This affects an unknown part of the file /resolve. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the a…
CVE-2025-1818MEDIUMCVSS 6.3EG 6.3
2025-03-02
A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/java/com/futvan/z/system/zfile/ZfileAction.upload. The manipulation of the argumen…
CVE-2025-1791MEDIUMCVSS 6.3EG 6.3
2025-03-01
A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument save_data lead…
CVE-2025-1598MEDIUMCVSS 6.3EG 6.3
2025-02-24
A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/asset_crud.php. The manipulation of the ar…
CVE-2025-1166MEDIUMCVSS 6.3EG 6.3
2025-02-11
A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file endpoint/update.php. The manipulation leads to unrestricted upload. T…
CVE-2025-0702MEDIUMCVSS 6.3EG 6.3
2025-01-24
A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This vulnerability affects unknown code of the file src/main/java/io/github/controller/SysFileController.java. The manip…
CVE-2025-0463MEDIUMCVSS 6.3EG 6.3
2025-01-14
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affected is an unknown function of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action…
CVE-2025-0402MEDIUMCVSS 6.3EG 6.3
2025-01-13
A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argumen…
CVE-2025-0341MEDIUMCVSS 6.3EG 6.3
2025-01-09
A vulnerability, which was classified as critical, has been found in CampCodes Computer Laboratory Management System 1.0. Affected by this issue is some unknown functionality of the file /class/edit/edit. The manipulation of the argument e…
CVE-2025-0335MEDIUMCVSS 6.3EG 6.3
2025-01-09
A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload.…
CVE-2024-13212MEDIUMCVSS 6.3EG 6.3
2025-01-09
A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/house/wym/controller/AddHouseController.java. The manipulation of the argument file …
CVE-2024-13191MEDIUMCVSS 6.3EG 6.3
2025-01-08
A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. The manipulation of the argume…
CVE-2024-13145MEDIUMCVSS 6.3EG 6.3
2025-01-06
A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/site/blog/my/core/controller/admin/uploadController. java. The manipulation of …
CVE-2024-13144MEDIUMCVSS 6.3EG 6.3
2025-01-06
A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the arg…
CVE-2024-13134MEDIUMCVSS 6.3EG 6.3
2025-01-05
A vulnerability, which was classified as critical, was found in ZeroWdd studentmanager 1.0. Affected is the function addTeacher/editTeacher of the file src/main/Java/com/wdd/studentmanager/controller/TeacherController. java. The manipulati…
CVE-2024-13133MEDIUMCVSS 6.3EG 6.3
2025-01-05
A vulnerability, which was classified as critical, has been found in ZeroWdd studentmanager 1.0. This issue affects the function addStudent/editStudent of the file src/main/Java/com/wdd/studentmanager/controller/StudentController. java. Th…
CVE-2025-0213MEDIUMCVSS 6.3EG 6.3
2025-01-04
A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forms/update_forms.php?action=change_pic2&id=4. The manipulation of the argument f…
CVE-2024-13022MEDIUMCVSS 6.3EG 6.3
2024-12-29
A vulnerability, which was classified as critical, was found in taisan tarzan-cms 1.0.0. This affects the function UploadResponse of the file src/main/java/com/tarzan/cms/modules/admin/controller/common/UploadController.java of the compone…
CVE-2024-12956MEDIUMCVSS 6.3EG 6.3
2024-12-26
A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /add_achievement_details.php. The manipulation of the argument ach_certy lead…
CVE-2024-12954MEDIUMCVSS 6.3EG 6.3
2024-12-26
A vulnerability, which was classified as critical, was found in 1000 Projects Portfolio Management System MCA 1.0. This affects an unknown part of the file /update_ach.php. The manipulation of the argument ach_certy leads to unrestricted u…
CVE-2024-12953MEDIUMCVSS 6.3EG 6.3
2024-12-26
A vulnerability, which was classified as critical, has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected by this issue is some unknown functionality of the file /update_pd_process.php. The manipulation of the argume…
CVE-2024-12951MEDIUMCVSS 6.3EG 6.3
2024-12-26
A vulnerability classified as critical has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected is an unknown function of the file /add_personal_details.php. The manipulation of the argument profile leads to unrestrict…
CVE-2024-47151MEDIUMCVSS 6.3EG 6.3
2024-12-26
Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
CVE-2024-55514MEDIUMCVSS 6.3EG 6.3
2024-12-17
A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_sfmig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentia…
CVE-2024-12478MEDIUMCVSS 6.3EG 6.3
2024-12-16
A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unre…
CVE-2024-53619MEDIUMCVSS 6.3EG 6.3
2024-11-26
An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CVE-2024-11674MEDIUMCVSS 6.3EG 6.3
2024-11-26
A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads …
CVE-2024-11122MEDIUMCVSS 6.3EG 6.3
2024-11-12
A vulnerability, which was classified as critical, has been found in 上海灵当信息科技有限公司 Lingdang CRM up to 8.6.4.3. Affected by this issue is some unknown functionality of the file /crm/wechatSession/index.php?msgid=1&ope…
CVE-2024-11054MEDIUMCVSS 6.3EG 6.3
2024-11-10
A vulnerability classified as critical was found in SourceCodester Simple Music Cloud Community System 1.0. This vulnerability affects unknown code of the file /music/ajax.php?action=signup. The manipulation of the argument pp leads to unr…
CVE-2024-10994MEDIUMCVSS 6.3EG 6.3
2024-11-08
A vulnerability has been found in Codezips Online Institute Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edit_user.php. The manipulation of the argument image lea…
CVE-2024-10993MEDIUMCVSS 6.3EG 6.3
2024-11-08
A vulnerability, which was classified as critical, was found in Codezips Online Institute Management System 1.0. Affected is an unknown function of the file /manage_website.php. The manipulation of the argument website_image leads to unres…
CVE-2024-10766MEDIUMCVSS 6.3EG 6.3
2024-11-04
A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/save_user.php. The manipulation of the argument image…
CVE-2024-10765MEDIUMCVSS 6.3EG 6.3
2024-11-04
A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file /profile.php. The manipulation of the argument old_image leads to unrestricted u…
CVE-2024-10764MEDIUMCVSS 6.3EG 6.3
2024-11-04
A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. I…
CVE-2024-10420MEDIUMCVSS 6.3EG 6.3
2024-10-27
A vulnerability classified as critical has been found in SourceCodester Attendance and Payroll System 1.0. This affects the function upload of the file /marimar/guest/update.php. The manipulation of the argument image leads to unrestricted…
CVE-2024-10413MEDIUMCVSS 6.3EG 6.3
2024-10-27
A vulnerability, which was classified as critical, has been found in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is the function upload of the file /guest/update.php. The manipulation of the argument image le…
CVE-2024-10410MEDIUMCVSS 6.3EG 6.3
2024-10-27
A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Affected by this vulnerability is the function upload of the file /admin/mod_room/controller.php?action=add. The manipulation of the ar…
CVE-2024-10293MEDIUMCVSS 6.3EG 6.3
2024-10-23
A vulnerability was found in ZZCMS 2023. It has been classified as critical. Affected is the function Ebak_SetGotoPak of the file 3/Ebbak5.1/upload/class/functions.php. The manipulation of the argument file leads to unrestricted upload. It…
CVE-2024-10292MEDIUMCVSS 6.3EG 6.3
2024-10-23
A vulnerability was found in ZZCMS 2023 and classified as critical. This issue affects some unknown processing of the file 3/Ebak5.1/upload/ChangeTable.php. The manipulation of the argument savefilename leads to unrestricted upload. The at…
CVE-2024-10161MEDIUMCVSS 6.3EG 6.3
2024-10-20
A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file change-image.php of the component Update Boat Image Page. The manipulation of the argument image l…
CVE-2024-9975MEDIUMCVSS 6.3EG 6.3
2024-10-15
A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.php. The manipulation leads to unrestricted upload. The att…
CVE-2024-9794MEDIUMCVSS 6.3EG 6.3
2024-10-10
A vulnerability, which was classified as critical, has been found in Codezips Online Shopping Portal 1.0. This issue affects some unknown processing of the file /update-image1.php. The manipulation of the argument productimage1 leads to un…
CVE-2024-9036MEDIUMCVSS 6.3EG 6.3
2024-09-20
A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_add.php. The manipulation of the argument image leads to unrestricted upload. The a…
CVE-2024-8342MEDIUMCVSS 6.3EG 6.3
2024-08-30
A vulnerability, which was classified as critical, has been found in SourceCodester Petshop Management System 1.0. This issue affects some unknown processing of the file /controllers/add_client.php. The manipulation of the argument image_p…
CVE-2024-8341MEDIUMCVSS 6.3EG 6.3
2024-08-30
A vulnerability classified as critical was found in SourceCodester Petshop Management System 1.0. This vulnerability affects unknown code of the file /controllers/add_user.php. The manipulation of the argument avatar leads to unrestricted …
CVE-2024-8338MEDIUMCVSS 6.3EG 6.3
2024-08-30
A vulnerability was found in HFO4 shudong-share 2.4.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /includes/fileReceive.php of the component File Extension Handler. The manipula…

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →