Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,560)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-2268 1Keerti1924 1Online Bookstore Website Jun 17, 2026 Mar 7, 2024 N/A· v4 9.8 CRITICAL· v3 5.8 MEDIUM· v2 A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0. It has been classified as critical. Affected is an unknown function of the file /product_update.php?update=1. The manipulation of the argument update...Show more A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0. It has been classified as critical. Affected is an unknown function of the file /product_update.php?update=1. The manipulation of the argument update_image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256038 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2024-1986 1Booster 1Booster For Woocommerce Jun 17, 2026 Mar 7, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This ma...Show more The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable when the user product upload functionality is enabled.Show less
CVE-2024-27733 - - Jun 17, 2026 Mar 7, 2024 N/A· v4 7.7 HIGH· v3 N/A· v2 File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component.
CVE-2023-45599 1Ailux 1Imx6 Jun 17, 2026 Mar 5, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file...Show more A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.Show less
CVE-2023-45595 1Ailux 1Imx6 Jun 17, 2026 Mar 5, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into...Show more A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.Show less
CVE-2024-2148 1Oretnom23 1Online Mobile Store Management System Jun 17, 2026 Mar 3, 2024 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unres...Show more A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255501 was assigned to this vulnerability.Show less
CVE-2024-27747 1Mayurik 1Petrol Pump Management Jun 17, 2026 Mar 1, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
CVE-2024-2059 1Mayurik 1Petrol Pump Management Jun 17, 2026 Mar 1, 2024 N/A· v4 7.2 HIGH· v3 5.8 MEDIUM· v2 A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulati...Show more A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-255374 is the identifier assigned to this vulnerability.Show less
CVE-2024-2058 1Mayurik 1Petrol Pump Management Jun 17, 2026 Mar 1, 2024 N/A· v4 7.2 HIGH· v3 5.8 MEDIUM· v2 A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipu...Show more A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255373 was assigned to this vulnerability.Show less
CVE-2024-0864 1Laragon 1Laragon Jun 17, 2026 Feb 29, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By defa...Show more Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.Show less
CVE-2023-6090 1Mollie 1Mollie Payments For Woocommerce Jun 17, 2026 Feb 29, 2024 N/A· v4 7.2 HIGH· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type vulnerability in Mollie Mollie Payments for WooCommerce.This issue affects Mollie Payments for WooCommerce: from n/a through 7.3.11.
CVE-2024-1468 1Theme Fusion 1Avada Jun 17, 2026 Feb 29, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 The Avada \| Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and inc...Show more The Avada \| Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.Show less
CVE-2024-25832 1F Logic 1Datacube3 Jun 17, 2026 Feb 29, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension.
CVE-2024-24146 1Libming 1Libming Jun 17, 2026 Feb 29, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF file.
CVE-2024-23946 1Apache 1Ofbiz Jun 17, 2026 Feb 29, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
CVE-2023-25921 1Ibm 1Security Guardium Key Lifecycle Manager Jun 17, 2026 Feb 29, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-...Show more IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247620. Show less
CVE-2024-25869 1Codeastro 1Membership Management System Jun 17, 2026 Feb 28, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component.
CVE-2023-25922 1Ibm 1Security Guardium Key Lifecycle Manager Jun 17, 2026 Feb 28, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-...Show more IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621.Show less
CVE-2024-1932 1Freescout 1Freescout Jun 17, 2026 Feb 28, 2024 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout
CVE-2024-25846 2Myprestamodules Simpleimportproduct Project 2Product Catalog (csv, Excel) Import Simpleimportproduct Jun 17, 2026 Feb 27, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php.

Previous 1...119120121...228 Next