CWE-434
4,107 CVEs • Abstraction: Base • Likelihood of Exploit: Medium
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVEs (4,107)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. |
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. |
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files |
1D8s Strings Project 1D8s Strings Jun 17, 2026 Sep 19, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0. |
The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0. |
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0. |
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
1D8s Netstrings Project 1D8s Netstrings Jun 17, 2026 Sep 19, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
1D8s Grammars Project 1D8s Grammars Jun 17, 2026 Sep 19, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
1D8s Archives Project 1D8s Archives Jun 17, 2026 Sep 19, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
1Garage Management System Project 1Garage Management System Jun 17, 2026 Sep 16, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action/editProductImage.php?id=1. |
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the serve...Show more |
1Event Management System Project 1Event Management System Jun 17, 2026 Sep 15, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php. This vulnerability allows attackers to execute arbitrary code via a crafted P...Show more |
PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file ope...Show more |
1Garage Management System Project 1Garage Management System Jun 17, 2026 Sep 14, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the atta...Show more |
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. |
Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager. |
An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary file to a victim's local ~/Downloads/ directory is possible if the victim is using the AnyDesk Windows client to connect t...Show more |