Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,559)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-2678 1Alphaware E Commerce System Project 1Alphaware E Commerce System Jun 17, 2026 Aug 5, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 A vulnerability was found in SourceCodester Alphaware Simple E-Commerce System. It has been declared as critical. This vulnerability affects unknown code of the file admin_feature.php of the component Background Manageme...Show more A vulnerability was found in SourceCodester Alphaware Simple E-Commerce System. It has been declared as critical. This vulnerability affects unknown code of the file admin_feature.php of the component Background Management Page. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-205666 is the identifier assigned to this vulnerability.Show less
CVE-2022-2647 1Jeecg 1Jeecg Boot Jun 17, 2026 Aug 4, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the argument file leads to unrestricted upload. The attack can be...Show more A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-205594 is the identifier assigned to this vulnerability.Show less
CVE-2022-34613 1Mealie Project 1Mealie Jun 17, 2026 Aug 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file.
CVE-2022-34154 1Ideastocode 1Enable Svg, Webp & Ico Upload Jun 17, 2026 Aug 1, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
CVE-2022-34496 1Hiby 2Hiby R3 Pro Firmware Hiby R3 Pro Saber Firmware Jun 17, 2026 Jul 29, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature.
CVE-2022-34578 1Opensourcepos 1Open Source Point Of Sale Jun 17, 2026 Jul 28, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page.
CVE-2022-34120 1Barangay Management System Project 1Barangay Management System Jun 17, 2026 Jul 27, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pages/activity/activity.php.
CVE-2022-34549 1Sims Project 1Sims Jun 17, 2026 Jul 27, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate privileges and execute arbitrary commands via a crafted file.
CVE-2022-34971 1Feehi 1Feehi Cms Jun 17, 2026 Jul 27, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-34965 1Openteknik 1Open Source Social Network Jun 17, 2026 Jul 25, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute...Show more OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this is intended behavior of the application as it only allows authenticated admins to upload files.Show less
CVE-2022-34115 1Dataease 1Dataease Jun 17, 2026 Jul 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
CVE-2022-28700 1Givewp 1Givewp Jun 17, 2026 Jul 21, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
CVE-2022-34024 1Barangay Management System Project 1Barangay Management System Jun 17, 2026 Jul 19, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at /bmis/pages/resident/resident.php.
CVE-2022-1565 1Wpallimport 1Wp All Import Jun 17, 2026 Jul 18, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated...Show more The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.Show less
CVE-2022-24688 1Dsk 1Dsknet Jun 17, 2026 Jul 18, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attack...Show more An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page.Show less
CVE-2021-36711 1Octobot 1Octobot Jun 17, 2026 Jul 16, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
CVE-2022-31161 1Roxy Wi 1Roxy Wi Jun 17, 2026 Jul 15, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received f...Show more Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.Show less
CVE-2022-32119 1Arox 1School Erp Pro Jul 9, 2026 Jul 15, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php.
CVE-2021-36461 1Microweber 1Microweber Jun 17, 2026 Jul 15, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini.
CVE-2022-2420 1Eveo 1Urve Web Manager Jun 17, 2026 Jul 15, 2022 N/A· v4 8.0 HIGH· v3 N/A· v2 A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs...Show more A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.Show less

Previous 1...162163164...228 Next