Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,560)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-43283 1Webassembly 1Wabt Jun 17, 2026 Oct 28, 2022 N/A· v4 5.5 MEDIUM· v3 N/A· v2 wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.
CVE-2022-43231 1Canteen Management System Project 1Canteen Management System Jun 17, 2026 Oct 28, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_website.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-37426 1Opennebula 1Opennebula Jun 17, 2026 Oct 28, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection.
CVE-2022-43275 1Canteen Management System Project 1Canteen Management System Jun 17, 2026 Oct 28, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted...Show more Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.Show less
CVE-2022-33859 1Eaton 1Foreseer Electrical Power Monitoring System Jun 17, 2026 Oct 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime cause...Show more A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. A threat actor may upload arbitrary files using the file upload feature. This vulnerability is present in versions 4.x, 5.x, 6.x & 7.0 to 7.5. A new version (v7.6) containing the remediation has been made available by Eaton and a mitigation has been provided for the affected versions that are currently supported. Customers are advised to update the software to the latest version (v7.6). Foreseer EPMS versions 4.x, 5.x, 6.x are no longer supported by Eaton. Please refer to the End-of-Support notification https://www.eaton.com/in/en-us/catalog/services/foreseer/foreseer-legacy.html .Show less
CVE-2021-38397 1Honeywell 4Application Control Environment Firmware C200 FirmwareC200e Firmware+1 more Jun 17, 2026 Oct 28, 2022 N/A· v4 10.0 CRITICAL· v3 N/A· v2 Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
CVE-2022-39978 1Online Pet Shop We App Project 1Online Pet Shop We App Jun 17, 2026 Oct 27, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerability allows attackers to execute arbitrary code via a crafte...Show more Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point.Show less
CVE-2022-39977 1Online Pet Shop We App Project 1Online Pet Shop We App Jun 17, 2026 Oct 27, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP fi...Show more Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point.Show less
CVE-2022-41711 1Uatech 1Badaso Jun 17, 2026 Oct 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
CVE-2022-36452 1Mitel 1Micollab Jun 17, 2026 Oct 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary c...Show more A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application.Show less
CVE-2022-39305 1Gin Vue Admin Project 1Gin Vue Admin Jun 17, 2026 Oct 24, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd...Show more Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in an arbitrary file being read. This issue is patched in 2.5.4b. There are no known workarounds.Show less
CVE-2022-42189 1Emlog 1Emlog Jun 17, 2026 Oct 21, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.
CVE-2022-42201 1Simple Exam Reviewer Management System Project 1Simple Exam Reviewer Management System Jun 17, 2026 Oct 20, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
CVE-2022-42198 1Simple Exam Reviewer Management System Project 1Simple Exam Reviewer Management System Jun 17, 2026 Oct 20, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.
CVE-2022-31366 1Eve Ng 1Eve Ng Jul 9, 2026 Oct 20, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file.
CVE-2022-39301 1Sra Admin Project 1Sra Admin Jun 17, 2026 Oct 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an at...Show more sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in "Personal Center" - "Profile Picture Upload" allowing theft of the user's personal information. This issue has been patched in 1.1.2. There are no known workarounds.Show less
CVE-2022-41537 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Oct 18, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user_operations/profile.php. This vulnerability allows attackers to execute arbitrary code...Show more Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user_operations/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.Show less
CVE-2022-41504 1Billing System Project 1Billing System Jun 17, 2026 Oct 18, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2020-8974 1Zigor 1Zgr Tps200 Ng Firmware Jun 17, 2026 Oct 17, 2022 N/A· v4 9.1 CRITICAL· v3 N/A· v2 In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modific...Show more In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.Show less
CVE-2022-3552 1Boxbilling 1Boxbilling Jun 17, 2026 Oct 17, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.

Previous 1...156157158...228 Next