Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,560)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-48194 1Tp Link 1Tl Wr902ac Firmware Jun 17, 2026 Dec 30, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequa...Show more TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequate.Show less
CVE-2022-45427 1Dahuasecurity 5Dhi Dss4004 S2 Firmware Dhi Dss7016d S2 FirmwareDhi Dss7016dr S2 Firmware+2 more Jun 17, 2026 Dec 27, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can uploa...Show more Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can upload arbitrary files.Show less
CVE-2022-4732 1Microweber 1Microweber Jun 17, 2026 Dec 27, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-45896 1Planetestream 1Planet Estream Jun 17, 2026 Dec 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execu...Show more Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution.Show less
CVE-2022-4665 1Ampache 1Ampache Jun 17, 2026 Dec 23, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6.
CVE-2022-46493 1Nbnbk Project 1Nbnbk Jun 17, 2026 Dec 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/download_img.
CVE-2022-45415 1Mozilla 1Firefox Jun 17, 2026 Dec 22, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded...Show more When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran. This vulnerability affects Firefox < 107.Show less
CVE-2022-34483 1Mozilla 1Firefox Jun 17, 2026 Dec 22, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into e...Show more An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102.Show less
CVE-2022-34482 1Mozilla 1Firefox Jun 17, 2026 Dec 22, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into e...Show more An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102.Show less
CVE-2022-0517 1Mozilla 1Vpn Jun 17, 2026 Dec 22, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mo...Show more Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN < 2.7.1.Show less
CVE-2022-46102 1Ayacms Project 1Ayacms Jun 17, 2026 Dec 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php
CVE-2022-45966 1Classcms Project 1Classcms Jun 17, 2026 Dec 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
CVE-2022-46020 1Wbce 1Wbce Cms Jun 17, 2026 Dec 20, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
CVE-2022-46135 1Aerocms Project 1Aerocms Jun 17, 2026 Dec 16, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which we can upload webshell and control the web server.
CVE-2022-45338 1Exactsoftware 1Exact Synergy Jun 17, 2026 Dec 15, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a...Show more An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 before 500SP6 allows attackers to execute arbitrary code via a crafted SVG file.Show less
CVE-2020-20588 1Ibarn Project 1Ibarn Jun 17, 2026 Dec 15, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php.
CVE-2022-4506 1Open Emr 1Openemr Jun 17, 2026 Dec 15, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2.
CVE-2022-41267 1Sap 1Business Objects Business Intelligence Platform Jun 17, 2026 Dec 13, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take...Show more SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a high impact on confidentiality, integrity, and availability of the application.Show less
CVE-2022-45275 1Dynamic Transaction Queuing System Project 1Dynamic Transaction Queuing System Jun 17, 2026 Dec 12, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-3912 1Wpeverest 1User Registration Jun 17, 2026 Dec 12, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated us...Show more The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.Show less

Previous 1...152153154...228 Next