Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,559)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-41386 1Democritus 1D8s Utility Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
CVE-2022-41385 1Democritus 1D8s Html Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
CVE-2022-41384 1Democritus 1D8s Domains Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.
CVE-2022-41383 1Democritus 1D8s Archives Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVE-2022-41382 1Democritus 1D8s Json Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVE-2022-41381 1Democritus 1D8s Utility Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVE-2022-41380 1Democritus 1D8s Yaml Jun 17, 2026 Oct 11, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVE-2022-42229 1Wedding Planner Project 1Wedding Planner Jun 17, 2026 Oct 11, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php.
CVE-2022-42034 1Wedding Planner Project 1Wedding Planner Jun 17, 2026 Oct 11, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.
CVE-2022-3436 1Web Based Student Clearance System Project 1Web Based Student Clearance System Jun 17, 2026 Oct 9, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Photo Hand...Show more A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-210367.Show less
CVE-2022-41379 1Online Leave Management System Project 1Online Leave Management System Jun 17, 2026 Oct 7, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-42092 1Backdropcms 1Backdrop Cms Jun 17, 2026 Oct 7, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.
CVE-2022-41512 1Online Diagnostic Lab Management System Project 1Online Diagnostic Lab Management System Jun 17, 2026 Oct 7, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-40721 1Creativedream File Uploader Project 1Creativedream File Uploader Jun 17, 2026 Oct 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Arbitrary file upload vulnerability in php uploader
CVE-2022-3125 1Najeebmedia 1Frontend File Manager Jun 17, 2026 Oct 3, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to uploa...Show more The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCEShow less
CVE-2022-40886 1Dedecms 1Dedecms Jun 17, 2026 Oct 3, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 DedeCMS 5.7.98 has a file upload vulnerability in the background.
CVE-2022-40341 1Mojoportal 1Mojoportal Jul 9, 2026 Sep 30, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file.
CVE-2022-41437 1Billing System Project Project 1Billing System Project Jun 17, 2026 Sep 30, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php.
CVE-2022-36066 1Discourse 1Discourse Jun 17, 2026 Sep 29, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip...Show more Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.Show less
CVE-2022-40407 1Chamilo 1Chamilo Jun 17, 2026 Sep 29, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.

Previous 1...158159160...228 Next