Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,107)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-0415 1Gogs 1Gogs Jun 17, 2026 Mar 21, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
CVE-2021-39384 1Diaowen 1Dwsurvey Jun 17, 2026 Mar 20, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java.
CVE-2020-26008 1Shopxo 1Shopxo Jun 17, 2026 Mar 20, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via uploading a crafted PHP file...Show more The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via uploading a crafted PHP file.Show less
CVE-2020-26007 1Shopxo 1Shopxo Jun 17, 2026 Mar 20, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2022-25581 1Classcms 1Classcms Jun 17, 2026 Mar 18, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.
CVE-2022-25602 1Expresstech 1Responsive Menu Jun 17, 2026 Mar 18, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).
CVE-2021-45835 1Online Admission System Project 1Online Admissions System Jun 17, 2026 Mar 18, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code exec...Show more The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution.Show less
CVE-2021-45834 1Opendocman 1Opendocman Jun 17, 2026 Mar 18, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed within the product's environment or lead to arbitrary code ex...Show more An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed within the product's environment or lead to arbitrary code execution.Show less
CVE-2022-26965 1Pluck Cms 1Pluck Jun 17, 2026 Mar 18, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
CVE-2021-45040 1Spatie 1Laravel Media Library Jun 17, 2026 Mar 17, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.
CVE-2022-0959 1Pgadmin 1Pgadmin 4 Jun 17, 2026 Mar 16, 2022 N/A· v4 6.5 MEDIUM· v3 3.5 LOW· v2 A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under wh...Show more A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.Show less
CVE-2022-25495 1Cuppacms 1Cuppacms Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP file.
CVE-2022-25487 1Thedigitalcraft 1Atomcms Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
CVE-2022-0951 1Showdoc 1Showdoc Jun 17, 2026 Mar 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.
CVE-2022-0950 1Showdoc 1Showdoc Jun 17, 2026 Mar 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
CVE-2022-0945 1Showdoc 1Showdoc Jun 17, 2026 Mar 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.
CVE-2022-24749 1Sylius 1Sylius Jun 17, 2026 Mar 14, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS...Show more Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround.Show less
CVE-2022-0962 1Showdoc 1Showdoc Jun 17, 2026 Mar 14, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVE-2022-0960 1Showdoc 1Showdoc Jun 17, 2026 Mar 14, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVE-2021-42171 1Tribalsystems 1Zenario Jun 17, 2026 Mar 14, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and...Show more Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.Show less

Previous 1...149150151...206 Next