← Back
CWE-434

4,377 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

JSON object

Loading...

CVEs (4,377)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-25132
1Cyberpower
1Powerpanel
Jun 17, 2026
Apr 24, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPa...Show more
Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors.Show less
CVE-2023-2246
1Online Pizza Ordering System Project
1Online Pizza Ordering System
Jun 17, 2026
Apr 23, 2023
N/A· v4
9.8 CRITICAL· v3
6.5 MEDIUM· v2
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of t...Show more
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236.Show less
CVE-2023-2245
1Hansuncms Project
1Hansuncms
Jun 17, 2026
Apr 22, 2023
N/A· v4
9.8 CRITICAL· v3
6.5 MEDIUM· v2
A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ashx?action=catchimage. The manipulation leads to unrestricted u...Show more
A vulnerability was found in hansunCMS 1.4.3. It has been declared as critical. This vulnerability affects unknown code of the file /ueditor/net/controller.ashx?action=catchimage. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227230 is the identifier assigned to this vulnerability.Show less
CVE-2023-28962
1Juniper
1Junos
Jun 17, 2026
Apr 17, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on th...Show more
An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on the device. This issue affects Juniper Networks Junos OS: All versions prior to 19.4R3-S11; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S7; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3-S6; 21.1 version 21.1R1 and later versions; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S3; 22.1 versions prior to 22.1R3-S1; 22.2 versions prior to 22.2R2-S1, 22.2R3; 22.3 versions prior to 22.3R1-S2, 22.3R2.Show less
CVE-2023-27755
171note
1Go Bbs
Jun 17, 2026
Apr 17, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.
CVE-2022-34128
1Glpi Project
1Positions
Jun 17, 2026
Apr 16, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.
CVE-2023-29627
1Online Pizza Ordering Project
1Online Pizza Ordering
Jun 17, 2026
Apr 14, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Online Pizza Ordering v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVE-2023-29625
1Employee Performance Evaluation System Project
1Employee Performance Evaluation System
Jun 17, 2026
Apr 14, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Employee Performance Evaluation System v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVE-2023-29621
1Purchase Order Management Project
1Purchase Order Management
Jun 17, 2026
Apr 14, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVE-2023-2034
1Froxlor
1Froxlor
Jun 17, 2026
Apr 14, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.
CVE-2023-26852
1Textpattern
1Textpattern
Jun 17, 2026
Apr 12, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file.
CVE-2020-19802
1Doyocms Project
1Doyocms
Jun 17, 2026
Apr 11, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
File Upload vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the upload file type parameter.
CVE-2023-27179
1Gdidees
1Gdidees Cms
Jun 17, 2026
Apr 11, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.
CVE-2023-27178
1Gdidees
1Gdidees Cms
Jun 17, 2026
Apr 10, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted file.
CVE-2023-1970
1Tpadmin Project
1Tpadmin
Jun 17, 2026
Apr 10, 2023
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the function Upload of the file application\admin\controller\Upload.php....Show more
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the function Upload of the file application\admin\controller\Upload.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225407. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.Show less
CVE-2023-29375
1Progress
1Sitefinity
Jun 17, 2026
Apr 10, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the...Show more
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the SharePoint connector.Show less
CVE-2023-1406
1Crocoblock
1Jetengine For Elementor
Jun 17, 2026
Apr 10, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
CVE-2023-27602
1Apache
1Linkis
Jun 17, 2026
Apr 10, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2.  For versions...Show more
In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2.  For versions <=1.3.1, we suggest turning on the file path check switch in linkis.properties `wds.linkis.workspace.filesystem.owner.check=true` `wds.linkis.workspace.filesystem.path.check=true`Show less
CVE-2023-27033
1Cdesigner Project
1Cdesigner
Jun 17, 2026
Apr 7, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFrontController::initContent().
CVE-2023-1942
1Oretnom23
1Online Computer And Laptop Store
Jun 17, 2026
Apr 7, 2023
N/A· v4
9.8 CRITICAL· v3
6.5 MEDIUM· v2
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/?page=user of the component...Show more
A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/?page=user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225319.Show less