Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,560)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-3295 1Unlimited Elements 1Unlimited Elements For Elementor Jun 17, 2026 Jun 17, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up t...Show more The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The issue was partially patched in version 1.5.66 and fully patched in 1.5.67. CVE-2023-31231 appears to be a duplicate of this issue.Show less
CVE-2023-34660 1Jeecg 1Jeecg Boot Jun 17, 2026 Jun 16, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface.
CVE-2023-34845 1Bludit 1Bludit Jun 17, 2026 Jun 16, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SV...Show more Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allows attackers to execute arbitrary web scripts or HTML via uploading a crafted SVG file. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).Show less
CVE-2023-32753 1Itpison 1Omicard Edm Jun 17, 2026 Jun 16, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitr...Show more OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.Show less
CVE-2023-32752 1L7 Networks 2Instantqos Instantscan Jun 17, 2026 Jun 16, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arb...Show more L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.Show less
CVE-2023-34833 1Thinkadmin 1Thinkadmin Jun 17, 2026 Jun 15, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.
CVE-2023-3274 1Supplier Management System Project 1Supplier Management System Jun 17, 2026 Jun 15, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of the file btn_functions.php of the component Picture Handler. The manipulation lead...Show more A vulnerability classified as critical has been found in code-projects Supplier Management System 1.0. Affected is an unknown function of the file btn_functions.php of the component Picture Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231624.Show less
CVE-2022-33166 1Ibm 1Security Directory Suite Va Jun 17, 2026 Jun 15, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 22...Show more IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 228586.Show less
CVE-2023-34747 1Ujcms 1Ujcms Jun 17, 2026 Jun 14, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.
CVE-2023-34944 1Chamilo 1Chamilo Lms Jul 9, 2026 Jun 13, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
CVE-2023-31541 1Ckeditor 1Ckeditor Jul 9, 2026 Jun 13, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
CVE-2023-3049 1Tmtmakine 1Lockcell Firmware Jun 17, 2026 Jun 13, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. This issue affects Lockcell: before 15.
CVE-2023-33253 1Agilebio 1Labcollector Jun 17, 2026 Jun 12, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is d...Show more LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file (such as shell.jpg.php.shell) being sent.Show less
CVE-2023-3187 1Teachers Record Management System Project 1Teachers Record Management System Jun 17, 2026 Jun 9, 2023 N/A· v4 5.4 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Pr...Show more A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176.Show less
CVE-2023-27881 1Ptc 1Vuforia Studio Jun 17, 2026 Jun 7, 2023 N/A· v4 9.9 CRITICAL· v3 N/A· v2 A user could use the “Upload Resource” functionality to upload files to any location on the disk.
CVE-2023-33498 2Alist Project Alistgo 2Alist Alist Jun 17, 2026 Jun 7, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.
CVE-2020-36705 1Tunasite 1Adning Advertising Jun 17, 2026 Jun 7, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible f...Show more The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.Show less
CVE-2023-33601 1Phpok 1Phpok Jun 17, 2026 Jun 7, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-4949 2Adsanityplugin Xen 2Adsanity Xen Jun 17, 2026 Jun 7, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticate...Show more The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible.Show less
CVE-2021-4382 1Recently Project 1Recently Jun 17, 2026 Jun 7, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in versions up to, and including, 3.0.4. This makes it possible for aut...Show more The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in versions up to, and including, 3.0.4. This makes it possible for authenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.Show less

Previous 1...141142143...228 Next