← Back
CWE-434

4,378 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

JSON object

Loading...

CVEs (4,378)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-43838
1Personal Management System
1Personal Management System
Jun 17, 2026
Oct 4, 2023
N/A· v4
7.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.
CVE-2023-44974
1Emlog
1Emlog
Jun 17, 2026
Oct 3, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-44973
1Emlog
1Emlog
Jun 17, 2026
Oct 3, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2023-4817
1Icpdas
1Et 7060 Firmware
Jun 17, 2026
Oct 3, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire device.
CVE-2022-47893
1Riello Ups
1Netman 204 Firmware
Jun 17, 2026
Oct 3, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.
CVE-2023-4097
1Qsige
1Qsige
Jun 17, 2026
Oct 3, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log into the application with a valid username.
CVE-2023-44009
1Mojoportal
1Mojoportal
Jun 17, 2026
Oct 2, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.
CVE-2023-44008
1Mojoportal
1Mojoportal
Jun 17, 2026
Oct 2, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.
CVE-2023-5227
1Phpmyfaq
1Phpmyfaq
Jun 17, 2026
Sep 30, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CVE-2023-5284
1Engineers Online Portal Project
1Engineers Online Portal
Jun 17, 2026
Sep 29, 2023
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_student.php. The manipulation of the argument uploaded_file lea...Show more
A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_student.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240912.Show less
CVE-2023-5277
1Engineers Online Portal Project
1Engineers Online Portal
Jun 17, 2026
Sep 29, 2023
N/A· v4
9.8 CRITICAL· v3
6.5 MEDIUM· v2
A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of the file student_avatar.php. The manipulation of the argument...Show more
A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of the file student_avatar.php. The manipulation of the argument change leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240905 was assigned to this vulnerability.Show less
CVE-2023-5262
1Openrapid
1Rapidcms
Jun 17, 2026
Sep 29, 2023
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. Affected by this vulnerability is the function isImg of the file /admin/config/uploadicon.php. The manipulation of the argument fileN...Show more
A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. Affected by this vulnerability is the function isImg of the file /admin/config/uploadicon.php. The manipulation of the argument fileName leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240871.Show less
CVE-2023-5185
1Projectworlds
1Gym Management System Project
Jun 17, 2026
Sep 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on the serve...Show more
Gym Management System Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'file' parameter of profile/i.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application. Show less
CVE-2023-43740
1Projectworlds
1Online Book Store Project
Jun 17, 2026
Sep 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of admin_edit.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server host...Show more
Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of admin_edit.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application. Show less
CVE-2023-43226
1Dedecms
1Dedecms
Jun 17, 2026
Sep 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2022-47186
1Generex
1Cs141 Firmware
Jun 17, 2026
Sep 28, 2023
N/A· v4
9.1 CRITICAL· v3
N/A· v2
There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "u...Show more
There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.Show less
CVE-2023-38874
1Economizzer
1Economizzer
Jun 17, 2026
Sep 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when ad...Show more
A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.Show less
CVE-2023-42462
1Glpi Project
1Glpi
Jun 17, 2026
Sep 27, 2023
N/A· v4
9.1 CRITICAL· v3
N/A· v2
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process c...Show more
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.Show less
CVE-2023-40219
1Welcart
1Welcart E Commerce
Jun 17, 2026
Sep 27, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized directory.
CVE-2023-39377
1Siberiancms
1Siberiancms
Jun 17, 2026
Sep 27, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method