Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,560)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-45968 2Alist Project Alistgo 2Alist Alist Jun 17, 2026 Dec 12, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).
CVE-2022-45759 1Sens Project 1Sens Jun 17, 2026 Dec 12, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 SENS v1.0 has a file upload vulnerability.
CVE-2022-46828 1Jetbrains 1Intellij Idea Jun 17, 2026 Dec 8, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
CVE-2022-45009 1Online Leave Management System Project 1Online Leave Management System Jun 17, 2026 Dec 7, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary...Show more Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.Show less
CVE-2022-45359 1Yithemes 1Yith Woocommerce Gift Cards Jun 17, 2026 Dec 6, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.
CVE-2022-45548 1Ayacms Project 1Ayacms Jun 17, 2026 Dec 6, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.
CVE-2022-44289 1Thinkphp 1Thinkphp Jun 17, 2026 Dec 6, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
CVE-2022-45912 1Zimbra 1Collaboration Jun 17, 2026 Dec 5, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the Client...Show more An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any other directory for remote code execution.Show less
CVE-2022-45771 1Pwndoc Project 1Pwndoc Jun 17, 2026 Dec 5, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file.
CVE-2022-4276 1House Rental System Project 1House Rental System Jun 17, 2026 Dec 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of t...Show more A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214772.Show less
CVE-2022-4273 1Oretnom23 1Human Resource Management System Jun 17, 2026 Dec 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the compone...Show more A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulation of the argument pfimg leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214769 was assigned to this vulnerability.Show less
CVE-2022-4272 1Warehouse Management System Project 1Warehouse Management System Jun 17, 2026 Dec 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfi...Show more A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/savenewproduct.php?flag=1. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214760.Show less
CVE-2022-36431 1Rocketsoftware 1Trufusion Jun 17, 2026 Dec 1, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1.
CVE-2022-4232 1Rinvizle 1Event Registration System Jun 17, 2026 Nov 30, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is poss...Show more A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation of the argument cmd leads to unrestricted upload. It is possible to launch the attack remotely. VDB-214590 is the identifier assigned to this vulnerability.Show less
CVE-2022-44354 1Contec 1Solarview Compact Firmware Jun 17, 2026 Nov 29, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file.
CVE-2022-38140 1Squirrly 1Seo Plugin By Squirrly Seo Jun 17, 2026 Nov 28, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.
CVE-2022-44401 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Nov 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php.
CVE-2022-44400 1Purchase Order Management System Project 1Purchase Order Management System Jun 17, 2026 Nov 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.
CVE-2022-45476 1Prasathmani 1Tiny File Manager Jun 17, 2026 Nov 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload...Show more Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload. Show less
CVE-2022-41705 1Uatech 1Badaso Jun 17, 2026 Nov 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

Previous 1...153154155...228 Next