CWE-434— Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.— MITRE CWE catalog
4,576 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-434page 90 of 92
- CVE-2024-9903MEDIUMCVSS 4.7EG 4.72024-10-12
A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upl…
- CVE-2024-9855MEDIUMCVSS 4.7EG 4.72024-10-11
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadFile of the file /admin/SysModule/upload/ajaxmodel/upload/uploadfilepath/sysmodule_…
- CVE-2024-9816MEDIUMCVSS 4.7EG 4.72024-10-10
A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads t…
- CVE-2024-9815MEDIUMCVSS 4.7EG 4.72024-10-10
A vulnerability has been found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/create-package.php. The manipulation of the argument package…
- CVE-2024-9280MEDIUMCVSS 4.7EG 4.72024-09-27
A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the arg…
- CVE-2024-9278MEDIUMCVSS 4.7EG 4.72024-09-27
A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verification_file of the file WxkConfig.php of the component Administrator Backend. The m…
- CVE-2024-8166MEDIUMCVSS 4.7EG 4.72024-08-26
A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=download&a=save. The manipulation of the argument content leads to unrestricted up…
- CVE-2024-7917MEDIUMCVSS 4.7EG 4.72024-08-18
A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the file /admin/system.php of the component Favicon Handler. The manipulation of the …
- CVE-2024-7910MEDIUMCVSS 4.7EG 4.72024-08-18
A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update H…
- CVE-2024-7706MEDIUMCVSS 4.7EG 4.72024-08-12
A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html. The manipulation of the argument upfile leads to unrestricted upload. The atta…
- CVE-2024-7705MEDIUMCVSS 4.7EG 4.72024-08-12
A vulnerability was found in Fujian mwcms 1.0.0. It has been declared as critical. Affected by this vulnerability is the function uploadeditor of the file /uploadeditor.html?action=uploadimage of the component Image Upload. The manipulatio…
- CVE-2024-7277MEDIUMCVSS 4.7EG 4.72024-07-31
A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/menu.php of the component Add a Menu. The manipulation of the argumen…
- CVE-2024-20296MEDIUMCVSS 4.7EG 4.72024-07-17
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would n…
- CVE-2024-6647MEDIUMCVSS 4.7EG 4.72024-07-10
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation o…
- CVE-2024-5043MEDIUMCVSS 4.7EG 4.72024-05-17
A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely…
- CVE-2024-4681MEDIUMCVSS 4.7EG 4.72024-05-14
A vulnerability, which was classified as critical, was found in Campcodes Legal Case Management System 1.0. Affected is an unknown function of the file /admin/general-setting of the component Setting Handler. The manipulation of the argume…
- CVE-2024-3521MEDIUMCVSS 4.7EG 4.72024-04-09
A vulnerability was found in Byzoro Smart S80 Management Platform up to 20240317. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php. The manipulation of the argume…
- CVE-2024-3444MEDIUMCVSS 4.7EG 4.72024-04-08
A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_keyword_import_save. The manipulation of the argument reqfile leads to unrestricted…
- CVE-2024-3117MEDIUMCVSS 4.7EG 4.72024-03-31
A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Action\Admin\ChannelAction.class.php. The manipulation of the argument file leads to unrestricted uplo…
- CVE-2024-2754MEDIUMCVSS 4.7EG 4.72024-03-21
A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. …
- CVE-2024-2394MEDIUMCVSS 4.7EG 4.72024-03-12
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/add-admin.php. The manipulation of the argument avatar leads…
- CVE-2024-2268MEDIUMCVSS 4.7EG 4.72024-03-07
A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0. It has been classified as critical. Affected is an unknown function of the file /product_update.php?update=1. The manipulation of the argument update_image leads to unr…
- CVE-2024-2059MEDIUMCVSS 4.7EG 4.72024-03-01
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument …
- CVE-2024-2058MEDIUMCVSS 4.7EG 4.72024-03-01
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipulation of the argum…
- CVE-2024-1921MEDIUMCVSS 4.7EG 4.72024-02-27
A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch …
- CVE-2024-1918MEDIUMCVSS 4.7EG 4.72024-02-27
A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The manipulation of the…
- CVE-2024-1819MEDIUMCVSS 4.7EG 4.72024-02-23
A vulnerability was found in CodeAstro Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the component Add Members Tab. The manipulation of the argument Member Photo leads to unrestricted…
- CVE-2024-1818MEDIUMCVSS 4.7EG 4.72024-02-23
A vulnerability was found in CodeAstro Membership Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /uploads/ of the component Logo Handler. The manipulation leads to unrestr…
- CVE-2024-1253MEDIUMCVSS 4.7EG 4.72024-02-06
A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknown functionality of the file /useratte/web.php of the component Import Handler. T…
- CVE-2024-1008MEDIUMCVSS 4.7EG 4.72024-01-29
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Profile Page. The manipula…
- CVE-2023-20196MEDIUMCVSS 4.7EG 4.72023-11-01
Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device.…
- CVE-2023-20195MEDIUMCVSS 4.7EG 4.72023-11-01
Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device.…
- CVE-2023-3852MEDIUMCVSS 4.7EG 4.72023-07-23
A vulnerability was found in OpenRapid RapidCMS up to 1.3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/upload.php. The manipulation of the argument file leads to unrestricted upload. The a…
- CVE-2023-2924MEDIUMCVSS 4.7EG 4.72023-05-27
A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of the file /admin/reportupload.aspx. The manipulation of the argument files[] lead…
- CVE-2023-2888MEDIUMCVSS 4.7EG 4.72023-05-25
A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0.1683794968. The manipulation leads to unrestricted upload. It is possible to in…
- CVE-2023-2419MEDIUMCVSS 4.7EG 4.72023-04-29
A vulnerability was found in Zhong Bang CRMEB 4.6.0. It has been declared as critical. This vulnerability affects the function videoUpload of the file \crmeb\app\services\system\attachment\SystemAttachmentServices.php. The manipulation of …
- CVE-2018-15424MEDIUMCVSS 4.7EG 4.72018-10-05
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the pri…
- CVE-2026-75331MEDIUMCVSS 4.6EG 4.62026-08-26
tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTM…
- CVE-2026-3219MEDIUMCVSS 4.6EG 4.62026-04-20
pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to t…
- CVE-2022-42449MEDIUMCVSS 4.6EG 4.62025-04-30
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
- CVE-2022-27562MEDIUMCVSS 4.6EG 4.62025-04-30
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.
- CVE-2022-44760MEDIUMCVSS 4.6EG 4.62025-04-24
Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.
- CVE-2024-40513MEDIUMCVSS 4.6EG 4.62025-01-16
An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function.
- CVE-2026-27146MEDIUMCVSS 4.5EG 4.52026-02-21
GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a result, an attacker can craft a malicious web page that silently triggers a file …
- CVE-2026-102366MEDIUMCVSS 4.4EG 4.42026-09-28
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or …
- CVE-2026-54179MEDIUMCVSS 4.4EG 4.42026-08-20
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/Sing…
- CVE-2025-14632MEDIUMCVSS 4.4EG 4.42026-01-17
The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploade…
- CVE-2020-4918MEDIUMCVSS 4.4EG 4.42021-01-04
IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service console for the Platform System Manager. IBM X-Force ID: 191392.
- CVE-2017-12332MEDIUMCVSS 4.4EG 4.42017-11-30
A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vulnerability is due to insufficient restrictions in the patch installation process.…
- CVE-2026-93550MEDIUMCVSS 4.3EG 4.32026-10-11
The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level ac…
Map vulnerabilities like CWE-434 to your infrastructure
EchelonGraph correlates every CVE — across CWE-434 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →