CWE-434— Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog

4,576 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-434page 84 of 92

CVE-2020-36825MEDIUMCVSS 6.3EG 6.3
2024-03-24
** UNSUPPORTED WHEN ASSIGNED ** ** DISPUTED ** A vulnerability has been found in cyberaz0r WebRAT up to 20191222 and classified as critical. This vulnerability affects the function download_file of the file Server/api.php. The manipulation…
CVE-2024-2849MEDIUMCVSS 6.3EG 6.3
2024-03-23
A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely.…
CVE-2024-2690MEDIUMCVSS 6.3EG 6.3
2024-03-20
A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file /uupdate.php. The manipulation of the argument ima leads to unrestricted upload. …
CVE-2024-2604MEDIUMCVSS 6.3EG 6.3
2024-03-18
A vulnerability was found in SourceCodester File Manager App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update-file.php. The manipulation of the argument file leads to unrestricted …
CVE-2024-2565MEDIUMCVSS 6.3EG 6.3
2024-03-17
A vulnerability was found in PandaXGO PandaX up to 20240310. It has been classified as critical. Affected is an unknown function of the file /apps/system/router/upload.go of the component File Extension Handler. The manipulation of the arg…
CVE-2024-2561MEDIUMCVSS 6.3EG 6.3
2024-03-17
A vulnerability, which was classified as critical, has been found in 74CMS 3.28.0. Affected by this issue is the function sendCompanyLogo of the file /controller/company/Index.php#sendCompanyLogo of the component Company Logo Handler. The …
CVE-2024-2531MEDIUMCVSS 6.3EG 6.3
2024-03-16
A vulnerability classified as critical has been found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. Affected is an unknown function of the file /admin/update-rooms.php. The manipulation leads to unrestricted upload. It is…
CVE-2024-2529MEDIUMCVSS 6.3EG 6.3
2024-03-16
A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/rooms.php. The manipulation leads to unrestricted upload…
CVE-2024-2148MEDIUMCVSS 6.3EG 6.3
2024-03-03
A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It …
CVE-2024-1875MEDIUMCVSS 6.3EG 6.3
2024-02-26
A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown processing of the file users/register-complaint.php of the component Lodge Complaint Section. The manip…
CVE-2024-1268MEDIUMCVSS 6.3EG 6.3
2024-02-07
A vulnerability, which was classified as critical, was found in CodeAstro Restaurant POS System 1.0. This affects an unknown part of the file update_product.php. The manipulation leads to unrestricted upload. It is possible to initiate the…
CVE-2024-1264MEDIUMCVSS 6.3EG 6.3
2024-02-07
A vulnerability has been found in Juanpao JPShop up to 1.5.02 and classified as critical. Affected by this vulnerability is the function actionUpdate of the file /api/controllers/common/UploadsController.php. The manipulation of the argume…
CVE-2024-1263MEDIUMCVSS 6.3EG 6.3
2024-02-06
A vulnerability, which was classified as critical, was found in Juanpao JPShop up to 1.5.02. Affected is the function actionUpdate of the file /api/controllers/merchant/shop/PosterController.php of the component API. The manipulation of th…
CVE-2024-1262MEDIUMCVSS 6.3EG 6.3
2024-02-06
A vulnerability, which was classified as critical, has been found in Juanpao JPShop up to 1.5.02. This issue affects the function actionUpdate of the file /api/controllers/merchant/design/MaterialController.php of the component API. The ma…
CVE-2024-1261MEDIUMCVSS 6.3EG 6.3
2024-02-06
A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of th…
CVE-2024-1260MEDIUMCVSS 6.3EG 6.3
2024-02-06
A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument p…
CVE-2024-1259MEDIUMCVSS 6.3EG 6.3
2024-02-06
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation o…
CVE-2024-1113MEDIUMCVSS 6.3EG 6.3
2024-01-31
A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted uplo…
CVE-2024-1027MEDIUMCVSS 6.3EG 6.3
2024-01-30
A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Post Handler. The manipulation leads to unrestricted upload. It is possible to lau…
CVE-2024-0933MEDIUMCVSS 6.3EG 6.3
2024-01-26
A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \app\model\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched rem…
CVE-2024-0783MEDIUMCVSS 6.3EG 6.3
2024-01-22
A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical. This issue affects some unknown processing of the file documents.php. The manipulation leads to unrestricted upload. The attack may be init…
CVE-2024-0468MEDIUMCVSS 6.3EG 6.3
2024-01-12
A vulnerability has been found in code-projects Fighting Cock Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/action/new-father.php. The manipulation of the a…
CVE-2011-10004MEDIUMCVSS 6.3EG 6.3
2023-10-17
A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file uploadImage.php. The manipulation leads to unrestricted upload. The attack may be i…
CVE-2023-3806MEDIUMCVSS 6.3EG 6.3
2023-07-21
A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an unknown function of the file btn_functions.php. The manipulation leads to unrestricted upload. It i…
CVE-2023-3626MEDIUMCVSS 6.3EG 6.3
2023-07-11
A vulnerability, which was classified as critical, has been found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This issue affects some unknown processing of the file /Duty/AjaxHandle/U…
CVE-2023-3625MEDIUMCVSS 6.3EG 6.3
2023-07-11
A vulnerability classified as critical was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230706. This vulnerability affects unknown code of the file /Duty/AjaxHandle/Write/UploadFile.ashx…
CVE-2023-3623MEDIUMCVSS 6.3EG 6.3
2023-07-11
A vulnerability was found in Suncreate Mountain Flood Disaster Prevention Monitoring and Early Warning System up to 20230704. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Duty/AjaxHandle/…
CVE-2023-3504MEDIUMCVSS 6.3EG 6.3
2023-07-04
A vulnerability was found in SmartWeb Infotech Job Board 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /settings/account of the component My Profile Page. The manipulation of the argument …
CVE-2023-3503MEDIUMCVSS 6.3EG 6.3
2023-07-04
A vulnerability has been found in SourceCodester Shopping Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file insert-product.php. The manipulation leads to unrestricted upload. The…
CVE-2023-3274MEDIUMCVSS 6.3EG 6.3
2023-06-15
A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of the file btn_functions.php of the component Picture Handler. The manipulation leads to unrestricted u…
CVE-2023-3187MEDIUMCVSS 6.3EG 6.3
2023-06-09
A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handl…
CVE-2023-3061MEDIUMCVSS 6.3EG 6.3
2023-06-02
A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file btn_functions.php of the component Attachment Image Handler. The manipulation l…
CVE-2023-2063MEDIUMCVSS 6.3EG 6.3
2023-06-02
Unrestricted Upload of File with Dangerous Type vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthen…
CVE-2014-125104MEDIUMCVSS 6.3EG 6.3
2023-06-01
A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPo…
CVE-2023-32689MEDIUMCVSS 6.3EG 6.3
2023-05-30
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A m…
CVE-2023-2776MEDIUMCVSS 6.3EG 6.3
2023-05-17
A vulnerability was found in code-projects Simple Photo Gallery 1.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-229282…
CVE-2023-2738MEDIUMCVSS 6.3EG 6.3
2023-05-16
A vulnerability classified as critical has been found in Tongda OA 11.10. This affects the function actionGetdata of the file GatewayController.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remot…
CVE-2023-2648MEDIUMCVSS 6.3EG 6.3
2023-05-11
A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It …
CVE-2023-2424MEDIUMCVSS 6.3EG 6.3
2023-04-29
A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be laun…
CVE-2023-2246MEDIUMCVSS 6.3EG 6.3
2023-04-23
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img lea…
CVE-2023-2245MEDIUMCVSS 6.3EG 6.3
2023-04-22
A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ashx?action=catchimage. The manipulation leads to unrestricted upload. The attack c…
CVE-2017-20063MEDIUMCVSS 6.3EG 6.3
2022-06-20
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege managem…
CVE-2025-8841MEDIUMCVSS 6.1EG 6.3
2025-08-11
A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The man…
CVE-2025-9795MEDIUMCVSS 5.4EG 6.3
2025-09-01
A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argument upfile leads…
CVE-2025-8764MEDIUMCVSS 5.4EG 6.3
2025-08-09
A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to…
CVE-2025-7906MEDIUMCVSS 5.4EG 6.3
2025-07-20
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulati…
CVE-2025-7864MEDIUMCVSS 5.4EG 6.3
2025-07-20
A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java. The manipulation leads to un…
CVE-2024-0192MEDIUMCVSS 5.4EG 6.3
2024-01-02
A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file downloadable.php of the component Add Downloadable. The manip…
CVE-2024-50652MEDIUMCVSS 4.3EG 6.3
2024-11-15
A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function.
CVE-2019-25616MEDIUMCVSS 6.2EG 6.2
2026-03-22
AnMing MP3 CD Burner 2.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized string. Attackers can paste a 6000-byte payload into the registration name field to trigger a …

Map vulnerabilities like CWE-434 to your infrastructure

EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →