CWE-434
4,107 CVEs • Abstraction: Base • Likelihood of Exploit: Medium
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVEs (4,107)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths. |
UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authenticated user to upload various files of different file types. Specifically, a .j...Show more |
1Hitachi 2Vantara Pentaho Vantara Pentaho Business Intelligence ServerJun 17, 2026 Nov 8, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. A reports (.prpt) file allows the inclusion of BeanShell scripts to ease the production of complex repo...Show more |
1Engineers Online Portal Project 1Engineers Online Portal Jun 17, 2026 Nov 5, 2021 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an avatar gets uploaded it is getting uploa...Show more |
An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands. |
Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code. |
S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted IMG file. |
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to up...Show more |
2Janobe Online Reviewer System Project2Online Reviewer System Online Reviewer SystemJun 17, 2026 Oct 29, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters.. |
1Oretnom23 1Budget And Expense Tracker System Jun 17, 2026 Oct 29, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user to inject arbitrary code via the image upload field. . |
2Online Food Ordering System Project Oretnom232Online Food Ordering System Online Food Ordering SystemJun 17, 2026 Oct 29, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters. |
1Church Management System Project 1Church Management System Jun 17, 2026 Oct 29, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field. |
1E Negosyo System Project 1E Negosyo System Jun 17, 2026 Oct 29, 2021 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert function, which validates images with getImageSizei. . |
A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file. |
A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file. |
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type |
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type |
1Customer Relationship Management System Project 1Customer Relationship Management System Jun 17, 2026 Oct 27, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option, which could let a remote malicious user upload an arbitrary php fil...Show more |
1Online Student Admission System Project 1Online Student Admission System Jun 17, 2026 Oct 26, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating their profile image to gain remote code execution. |
An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is...Show more |