CWE-434
4,559 CVEs • Abstraction: Base • Likelihood of Exploit: Medium
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVEs (4,559)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1D8s Grammars Project 1D8s Grammars Jun 17, 2026 Sep 19, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
1D8s Archives Project 1D8s Archives Jun 17, 2026 Sep 19, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0. |
1Garage Management System Project 1Garage Management System Jun 17, 2026 Sep 16, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action/editProductImage.php?id=1. |
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the serve...Show more |
1Event Management System Project 1Event Management System Jun 17, 2026 Sep 15, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php. This vulnerability allows attackers to execute arbitrary code via a crafted P...Show more |
PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file ope...Show more |
1Garage Management System Project 1Garage Management System Jun 17, 2026 Sep 14, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function. The vulnerability exist during adding parts and from the upload function, the atta...Show more |
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. |
Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager. |
An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary file to a victim's local ~/Downloads/ directory is possible if the victim is using the AnyDesk Windows client to connect t...Show more |
1Online Driving School Project Project 1Online Driving School Project Jun 17, 2026 Sep 7, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registration.php. The manipulation leads to unrestricted u...Show more |
There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP code. |
1Garage Management System Project 1Garage Management System Jun 17, 2026 Aug 31, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
1Online Ordering System Project 1Online Ordering System Jun 17, 2026 Aug 31, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file. |
1Garage Management System Project 1Garage Management System Jun 17, 2026 Aug 31, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a dangerous RCE or LCE exploit file. |
1Seiko Sol 2Skybridge Mb A100 Firmware Skybridge Mb A110 FirmwareJun 17, 2026 Aug 29, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup function. This vulnerability allows attackers to execute arbitrary code via a crafted...Show more |
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload. |
72crm 9.0 has an Arbitrary file upload vulnerability. |