← Back
CWE-434

4,560 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

JSON object

Loading...

CVEs (4,560)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-40555
1Project Team
1Tmall Demo
Jun 17, 2026
Jul 15, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload vulnerability.
CVE-2024-40553
1Project Team
1Tmall Demo
Jun 17, 2026
Jul 15, 2024
N/A· v4
4.9 MEDIUM· v3
N/A· v2
Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage.
CVE-2024-5630
1Elearningfreak
1Insert Or Embed Articulate Content
Jun 17, 2026
Jul 15, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
CVE-2024-6730
-
-
Jun 17, 2026
Jul 14, 2024
5.3 MEDIUM· v4
6.3 MEDIUM· v3
6.5 MEDIUM· v2
A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of the file /api/Common/uploadFile. The manipulation of the argu...Show more
A vulnerability was found in Nanjing Xingyuantu Technology SparkShop up to 1.1.6. It has been rated as critical. This issue affects some unknown processing of the file /api/Common/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271403.Show less
CVE-2024-5450
1Bug Library Project
1Bug Library
Jun 17, 2026
Jul 13, 2024
N/A· v4
9.1 CRITICAL· v3
N/A· v2
The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files
CVE-2024-5080
1Tipsandtricks Hq
1Wp Emember
Jun 17, 2026
Jul 13, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server
CVE-2024-40551
1Publiccms
1Publiccms
Jun 17, 2026
Jul 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40550
1Publiccms
1Publiccms
Jun 17, 2026
Jul 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlaceMetaData of Public CMS v.4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40549
1Publiccms
1Publiccms
Jun 17, 2026
Jul 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40548
1Publiccms
1Publiccms
Jun 17, 2026
Jul 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40546
1Publiccms
1Publiccms
Jun 17, 2026
Jul 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40545
1Publiccms
1Publiccms
Jun 17, 2026
Jul 12, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in the component /admin/cmsWebFile/doUpload of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-38736
-
-
Jun 17, 2026
Jul 12, 2024
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Unrestricted Upload of File with Dangerous Type vulnerability in Realtyna Realtyna Organic IDX plugin allows Code Injection.This issue affects Realtyna Organic IDX plugin: from n/a through 4.14.13.
CVE-2024-38734
-
-
Jun 17, 2026
Jul 12, 2024
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Unrestricted Upload of File with Dangerous Type vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Code Injection.This issue affects Import Spreadsheets from Microsoft Excel: from n/a t...Show more
Unrestricted Upload of File with Dangerous Type vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Code Injection.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.4.Show less
CVE-2024-3112
1Bestwebsoft
1Quotes And Tips
Jun 17, 2026
Jul 12, 2024
N/A· v4
4.8 MEDIUM· v3
N/A· v2
The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should n...Show more
The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)Show less
CVE-2024-5911
1Paloaltonetworks
1Pan Os
Jun 17, 2026
Jul 10, 2024
7.0 HIGH· v4
4.9 MEDIUM· v3
N/A· v2
An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeat...Show more
An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online.Show less
CVE-2024-6647
-
-
Jun 17, 2026
Jul 10, 2024
5.1 MEDIUM· v4
4.7 MEDIUM· v3
5.8 MEDIUM· v2
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler....Show more
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271053 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.Show less
CVE-2023-7061
1Advancedfilemanager
1File Manager Advanced Shortcode
Jun 17, 2026
Jul 10, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or...Show more
The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server which may make remote code execution possible.Show less
CVE-2024-39865
1Siemens
1Sinema Remote Connect Server
Jun 17, 2026
Jul 9, 2024
8.7 HIGH· v4
8.8 HIGH· v3
N/A· v2
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without...Show more
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without correctly checking the path of the restored file. This could allow an attacker with access to the backup encryption key to upload malicious files, that could potentially lead to remote code execution.Show less
CVE-2024-37424
-
-
Jun 17, 2026
Jul 9, 2024
N/A· v4
9.9 CRITICAL· v3
N/A· v2
Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8.