Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,377)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-1713 1Bitrix24 1Bitrix24 Jun 17, 2026 Nov 1, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a craf...Show more Insecure temporary file creation in bitrix/modules/crm/lib/order/import/instagram.php in Bitrix24 22.0.300 hosted on Apache HTTP Server allows remote authenticated attackers to execute arbitrary code via uploading a crafted ".htaccess" file.Show less
CVE-2023-40050 1Chef 1Automate Jun 17, 2026 Oct 31, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.
CVE-2023-5360 1Royal Elementor Addons 1Royal Elementor Addons Jun 17, 2026 Oct 31, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.
CVE-2023-42803 1Bigbluebutton 1Bigbluebutton Jun 17, 2026 Oct 30, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension befor...Show more BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.Show less
CVE-2023-5829 1Admission Management System Project 1Admission Management System Jun 17, 2026 Oct 27, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in code-projects Admission Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file student_avatar.php. The manipulation leads to un...Show more A vulnerability was found in code-projects Admission Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file student_avatar.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243728.Show less
CVE-2023-46815 1Sugarcrm 1Sugarcrm Jun 17, 2026 Oct 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected vi...Show more An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with regular user privileges can exploit this.Show less
CVE-2023-5812 1Flusity 1Flusity Jun 17, 2026 Oct 27, 2023 N/A· v4 8.8 HIGH· v3 5.8 MEDIUM· v2 A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tools/upload.php. The manipulation of the argument uploaded_file...Show more A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tools/upload.php. The manipulation of the argument uploaded_file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-243643.Show less
CVE-2023-5796 1Martmbithi 1Pos System Jun 17, 2026 Oct 26, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting of the component Logo Handler. The manipulation leads to unr...Show more A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243602 is the identifier assigned to this vulnerability.Show less
CVE-2023-5795 1Martmbithi 1Pos System Jun 17, 2026 Oct 26, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in CodeAstro POS System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /profil of the component Profile Picture Handler. The manipu...Show more A vulnerability was found in CodeAstro POS System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /profil of the component Profile Picture Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243601 was assigned to this vulnerability.Show less
CVE-2023-5790 1Remyandrade 1File Manager App Jun 17, 2026 Oct 26, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability classified as critical was found in SourceCodester File Manager App 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-file.php. The manipulation of the argument uplo...Show more A vulnerability classified as critical was found in SourceCodester File Manager App 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-file.php. The manipulation of the argument uploadedFileName leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243595.Show less
CVE-2023-45555 1Zzzcms 1Zzzcms Jun 17, 2026 Oct 25, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file.
CVE-2023-45554 1Zzzcms 1Zzzcms Jun 17, 2026 Oct 25, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, and png to jpg, jpeg,gif, png, pphphp.
CVE-2023-26578 1Idattend 1Idweb Jun 17, 2026 Oct 25, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server.
CVE-2023-5524 1M Files 1Web Companion Jun 17, 2026 Oct 20, 2023 N/A· v4 7.3 HIGH· v3 N/A· v2 Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types
CVE-2020-36706 1Simple Press 1Simple\ Jun 17, 2026 Oct 20, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and...Show more The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.Show less
CVE-2023-45384 1Knowband 1Supercheckout Jun 17, 2026 Oct 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files wi...Show more KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files with extensions .phpShow less
CVE-2023-37502 1Hcltech 1Hcl Compass Jun 17, 2026 Oct 18, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 HCL Compass is vulnerable to lack of file upload security. An attacker could upload files containing active code that can be executed by the server or by a user's web browser.
CVE-2023-46004 1Mayurik 1Best Courier Management System Jun 17, 2026 Oct 18, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.
CVE-2023-41631 1Esst 1Esst Monitoring Jun 17, 2026 Oct 17, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function.
CVE-2023-45952 1Lylme 1Lylme Spage Jun 17, 2026 Oct 17, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file.

Previous 1...122123124...219 Next