Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,376)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-45595 1Ailux 1Imx6 Jun 17, 2026 Mar 5, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into...Show more A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.Show less
CVE-2024-2148 1Oretnom23 1Online Mobile Store Management System Jun 17, 2026 Mar 3, 2024 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unres...Show more A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255501 was assigned to this vulnerability.Show less
CVE-2024-27747 1Mayurik 1Petrol Pump Management Jun 17, 2026 Mar 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
CVE-2024-2059 1Mayurik 1Petrol Pump Management Jun 17, 2026 Mar 1, 2024 N/A· v4 7.2 HIGH· v3 5.8 MEDIUM· v2 A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulati...Show more A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-255374 is the identifier assigned to this vulnerability.Show less
CVE-2024-2058 1Mayurik 1Petrol Pump Management Jun 17, 2026 Mar 1, 2024 N/A· v4 7.2 HIGH· v3 5.8 MEDIUM· v2 A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipu...Show more A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255373 was assigned to this vulnerability.Show less
CVE-2024-0864 1Laragon 1Laragon Jun 17, 2026 Feb 29, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By defa...Show more Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.Show less
CVE-2023-6090 1Mollie 1Mollie Payments For Woocommerce Jun 17, 2026 Feb 29, 2024 N/A· v4 7.2 HIGH· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type vulnerability in Mollie Mollie Payments for WooCommerce.This issue affects Mollie Payments for WooCommerce: from n/a through 7.3.11.
CVE-2024-1468 1Theme Fusion 1Avada Jun 17, 2026 Feb 29, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Avada \| Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and inc...Show more The Avada \| Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.Show less
CVE-2024-25832 1F Logic 1Datacube3 Jun 17, 2026 Feb 29, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension.
CVE-2024-24146 1Libming 1Libming Jun 17, 2026 Feb 29, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
CVE-2024-23946 1Apache 1Ofbiz Jun 17, 2026 Feb 29, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
CVE-2023-25921 1Ibm 1Security Guardium Key Lifecycle Manager Jun 17, 2026 Feb 29, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-...Show more IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620. Show less
CVE-2024-25869 1Codeastro 1Membership Management System Jun 17, 2026 Feb 28, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component.
CVE-2023-25922 1Ibm 1Security Guardium Key Lifecycle Manager Jun 17, 2026 Feb 28, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-...Show more IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621.Show less
CVE-2024-1932 1Freescout 1Freescout Jun 17, 2026 Feb 28, 2024 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout
CVE-2024-25846 2Myprestamodules Simpleimportproduct Project 2Product Catalog (csv, Excel) Import Simpleimportproduct Jun 17, 2026 Feb 27, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php.
CVE-2024-1925 1Ctcms Project 1Ctcms Jun 17, 2026 Feb 27, 2024 N/A· v4 8.1 HIGH· v3 4.6 MEDIUM· v2 A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Upsys.php. The manipulation leads to unrestricted upload. The a...Show more A vulnerability was found in Ctcms 2.1.2. It has been declared as critical. This vulnerability affects unknown code of the file ctcms/apps/controllers/admin/Upsys.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254860.Show less
CVE-2024-1921 1Osuuu 1Lightpicture Jun 17, 2026 Feb 27, 2024 N/A· v4 9.8 CRITICAL· v3 5.8 MEDIUM· v2 A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is...Show more A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254856.Show less
CVE-2024-1918 1Byzoro 1Smart S42 Management Platform Jun 17, 2026 Feb 27, 2024 N/A· v4 9.8 CRITICAL· v3 5.8 MEDIUM· v2 A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The...Show more A vulnerability has been found in Byzoro Smart S42 Management Platform up to 20240219 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument hidwel leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254839. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-41506 1Code Projects 1Student Enrollment Jun 17, 2026 Feb 27, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.

Previous 1...110111112...219 Next