CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,576 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 83 of 92

CVE-2024-8296MEDIUMCVSS 6.3EG 6.3
2024-08-29
A vulnerability was found in FeehiCMS up to 2.1.1 and classified as critical. This issue affects the function insert of the file /admin/index.php?r=user%2Fcreate. The manipulation of the argument User[avatar] leads to unrestricted upload. …
CVE-2024-8295MEDIUMCVSS 6.3EG 6.3
2024-08-29
A vulnerability has been found in FeehiCMS up to 2.1.1 and classified as critical. This vulnerability affects the function createBanner of the file /admin/index.php?r=banner%2Fbanner-create. The manipulation of the argument BannerForm[img]…
CVE-2024-8294MEDIUMCVSS 6.3EG 6.3
2024-08-29
A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1. This affects the function update of the file /admin/index.php?r=friendly-link%2Fupdate. The manipulation of the argument FriendlyLink[image] leads to unr…
CVE-2024-8164MEDIUMCVSS 6.3EG 6.3
2024-08-26
A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controllers/FileManagerController.php. This manipulation of the argument new_name causes…
CVE-2024-8089MEDIUMCVSS 6.3EG 6.3
2024-08-23
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/admin/products/controller.php. The manipulation of the argument photo leads to un…
CVE-2024-7944MEDIUMCVSS 6.3EG 6.3
2024-08-20
A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been classified as critical. Affected is the function UpdateDocumentsRequest of the file DocumentsController.php. The manipulation leads to unrestrict…
CVE-2024-7943MEDIUMCVSS 6.3EG 6.3
2024-08-20
A vulnerability was found in itsourcecode Laravel Property Management System 1.0 and classified as critical. This issue affects the function upload of the file PropertiesController.php. The manipulation of the argument file leads to unrest…
CVE-2024-7906MEDIUMCVSS 6.3EG 6.3
2024-08-18
A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function get_mime_type of the file /admin/dialog/select_images_post.php of the component Attachment Settings. The manipulation of the argumen…
CVE-2024-7905MEDIUMCVSS 6.3EG 6.3
2024-08-18
A vulnerability classified as critical has been found in DedeBIZ 6.3.0. This affects the function AdminUpload of the file admin/archives_do.php. The manipulation of the argument litpic leads to unrestricted upload. It is possible to initia…
CVE-2024-7904MEDIUMCVSS 6.3EG 6.3
2024-08-18
A vulnerability was found in DedeBIZ 6.3.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/file_manage_control.php of the component File Extension Handler. The manipulation of the argu…
CVE-2024-7903MEDIUMCVSS 6.3EG 6.3
2024-08-18
A vulnerability was found in DedeBIZ 6.3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/media_add.php of the component File Extension Handler. The manipulation of the argum…
CVE-2024-7506MEDIUMCVSS 6.3EG 6.3
2024-08-06
A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /setlogo.php. The manipulation of the argument bgimg leads to…
CVE-2024-7500MEDIUMCVSS 6.3EG 6.3
2024-08-06
A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function save_settings of the file admin/admin_class.php. The manipulation of the argument img leads to …
CVE-2024-7495MEDIUMCVSS 6.3EG 6.3
2024-08-06
A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to u…
CVE-2024-7450MEDIUMCVSS 6.3EG 6.3
2024-08-04
A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resume_upload.php of the component Image Handler. The manipu…
CVE-2024-7329MEDIUMCVSS 6.3EG 6.3
2024-07-31
A vulnerability, which was classified as critical, was found in YouDianCMS 7. Affected is an unknown function of the file /Public/ckeditor/plugins/multiimage/dialogs/image_upload.php. The manipulation of the argument files leads to unrestr…
CVE-2024-7192MEDIUMCVSS 6.3EG 6.3
2024-07-29
A vulnerability, which was classified as critical, was found in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/student.php. The manipulation of the argument image leads to unrestricted upload. I…
CVE-2024-7189MEDIUMCVSS 6.3EG 6.3
2024-07-29
A vulnerability classified as critical has been found in itsourcecode Online Food Ordering System 1.0. Affected is an unknown function of the file editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is …
CVE-2024-6958MEDIUMCVSS 6.3EG 6.3
2024-07-21
A vulnerability classified as critical was found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /st_update.php of the component Avatar File Handler. The manipulation of the argument pe…
CVE-2024-6948MEDIUMCVSS 6.3EG 6.3
2024-07-21
A vulnerability classified as critical has been found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected is an unknown function of the file /slideeditor.php of the component Slide Editor. The manipulation of the argume…
CVE-2024-6945MEDIUMCVSS 6.3EG 6.3
2024-07-21
A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been classified as critical. This affects an unknown part of the file app/Core/Http/Controllers/Profile/ImagesController.php of the component Avatar Upload Page. The manipulation…
CVE-2024-6801MEDIUMCVSS 6.3EG 6.3
2024-07-17
A vulnerability, which was classified as critical, has been found in SourceCodester Online Student Management System 1.0. This issue affects some unknown processing of the file /add-students.php. The manipulation of the argument image lead…
CVE-2024-6730MEDIUMCVSS 6.3EG 6.3
2024-07-14
A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of the file /api/Common/uploadFile. The manipulation of the argument file leads to …
CVE-2024-6280MEDIUMCVSS 6.3EG 6.3
2024-06-24
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument img leads to …
CVE-2024-6083MEDIUMCVSS 6.3EG 6.3
2024-06-18
A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/upload-mp3.php of the component Media Upload Page. The manipulation of the argument file leads to u…
CVE-2024-5734MEDIUMCVSS 6.3EG 6.3
2024-06-07
A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. Affected is an unknown function of the file /members/poster.php. The manipulation of the argument image leads to unrestricted upload. It is …
CVE-2024-5518MEDIUMCVSS 6.3EG 6.3
2024-05-30
A vulnerability classified as critical has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file change_profile_picture.php. The manipulation of the argument image leads to unrestricted upload. It…
CVE-2024-5145MEDIUMCVSS 6.3EG 6.3
2024-05-20
A vulnerability was found in SourceCodester Vehicle Management System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /newdriver.php of the component HTTP POST Request Handler. The manipulation …
CVE-2024-5050MEDIUMCVSS 6.3EG 6.3
2024-05-17
A vulnerability, which was classified as critical, was found in Wangshen SecGate 3600 up to 20240516. This affects an unknown part of the file /?g=log_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It i…
CVE-2024-5049MEDIUMCVSS 6.3EG 6.3
2024-05-17
A vulnerability, which was classified as critical, has been found in Codezips E-Commerce Site 1.0. Affected by this issue is some unknown functionality of the file admin/editproduct.php. The manipulation of the argument profilepic leads to…
CVE-2024-4964MEDIUMCVSS 6.3EG 6.3
2024-05-16
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This vulnerability affects unknown code of the file /firewall/urlblist.php. The manipulation of the argument file…
CVE-2024-4963MEDIUMCVSS 6.3EG 6.3
2024-05-16
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part of the file /url/url.php. The manipulation of the argument file_upload leads to u…
CVE-2024-4962MEDIUMCVSS 6.3EG 6.3
2024-05-16
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000-40 V31R02B1413C. Affected by this issue is some unknown functionality of the file /useratte/resmanage.php. The manipulatio…
CVE-2024-4961MEDIUMCVSS 6.3EG 6.3
2024-05-16
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-7000-40 V31R02B1413C. Affected by this vulnerability is an unknown functionality of the file /user/onlineuser.php. The manipulation of the argum…
CVE-2024-4960MEDIUMCVSS 6.3EG 6.3
2024-05-16
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000-40 V31R02B1413C. Affected is an unknown function of the file interface/sysmanage/licenseauthorization.php. The manipulation of the arg…
CVE-2024-4946MEDIUMCVSS 6.3EG 6.3
2024-05-16
A vulnerability was found in SourceCodester Online Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/adminHome.php. The manipulation of the arg…
CVE-2024-4923MEDIUMCVSS 6.3EG 6.3
2024-05-16
A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. …
CVE-2024-4921MEDIUMCVSS 6.3EG 6.3
2024-05-16
A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /employee_gatepass/classes/Users.php?f=ssave. The manipulation of the ar…
CVE-2024-4904MEDIUMCVSS 6.3EG 6.3
2024-05-15
A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_im…
CVE-2024-4820MEDIUMCVSS 6.3EG 6.3
2024-05-14
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/SystemSettings.php?f=update_settings. The m…
CVE-2024-4809MEDIUMCVSS 6.3EG 6.3
2024-05-14
A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo…
CVE-2024-33752MEDIUMCVSS 6.3EG 6.3
2024-05-06
An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit a special request to upload a malicious file to execute arbitrary code.
CVE-2024-4500MEDIUMCVSS 6.3EG 6.3
2024-05-05
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Employee/edit-photo.php. The manipulation of the argument userImage leads to u…
CVE-2024-31610MEDIUMCVSS 6.3EG 6.3
2024-04-25
File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitrary code via upload of crafted file.
CVE-2024-3948MEDIUMCVSS 6.3EG 6.3
2024-04-18
A vulnerability was found in SourceCodester Home Clean Service System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file \admin\student.add.php of the component Photo Handler. The manipulat…
CVE-2024-3804MEDIUMCVSS 6.3EG 6.3
2024-04-15
A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue affects some unknown processing of the file /Public/webuploader/0.1.5/server/fileupload2.php. The manipulation of the ar…
CVE-2024-3803MEDIUMCVSS 6.3EG 6.3
2024-04-15
A vulnerability classified as critical was found in Vesystem Cloud Desktop up to 20240408. This vulnerability affects unknown code of the file /Public/webuploader/0.1.5/server/fileupload.php. The manipulation of the argument file leads to …
CVE-2024-3436MEDIUMCVSS 6.3EG 6.3
2024-04-08
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the …
CVE-2024-3369MEDIUMCVSS 6.3EG 6.3
2024-04-06
A vulnerability, which was classified as critical, has been found in code-projects Car Rental 1.0. Affected by this issue is some unknown functionality of the file add-vehicle.php. The manipulation of the argument Upload Image leads to unr…
CVE-2024-3129MEDIUMCVSS 6.3EG 6.3
2024-04-01
A vulnerability was found in SourceCodester Image Accordion Gallery App 1.0. It has been classified as critical. This affects an unknown part of the file /endpoint/add-image.php. The manipulation of the argument image_name leads to unrestr…

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →