Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,558)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-32019 1Car Rental Management System Project 1Car Rental Management System Jun 17, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.php?action=save_car.
CVE-2021-45982 1Netscout 1Ngeniusone Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.
CVE-2022-30822 1Wedding Management System Project 1Wedding Management System Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file.
CVE-2022-30821 1Wedding Management System Project 1Wedding Management System Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability in the picture upload point of "package_edit.php" file.
CVE-2022-30820 1Wedding Management System Project 1Wedding Management System Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file.
CVE-2022-30819 1Wedding Management System Project 1Wedding Management System Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.
CVE-2022-30808 1Elitecms 1Elite Cms Jun 17, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.
CVE-2022-30506 1Mingsoft 1Mcms Jun 17, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
CVE-2022-30423 1Merchandise Online Store Project 1Merchandise Online Store Jun 17, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information.
CVE-2022-29725 1Creatiwity 1Witycms Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-29624 1Tpcms Project 1Tpcms Jun 17, 2026 Jun 2, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-24581 1Aceware 1Aceweb Online Portal Jul 9, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the usern...Show more ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.Show less
CVE-2022-24239 1Aceware 1Aceweb Online Portal Jul 9, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.
CVE-2021-33615 1Rsa 1Archer Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 8.5 HIGH· v2 RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.
CVE-2021-26634 1Maxb 1Maxboard Jun 17, 2026 Jun 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege e...Show more SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.Show less
CVE-2022-29637 1Iminho 1Mindoc Jun 17, 2026 May 26, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.
CVE-2022-29632 1Roncoo 1Roncoo Education Jun 17, 2026 May 26, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-29651 2Online Food Ordering System Project Oretnom23 2Online Food Ordering System Online Food Ordering System Jun 17, 2026 May 25, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2021-42654 1Sscms 1Siteserver Cms Jun 17, 2026 May 24, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitrary code.
CVE-2022-1837 1Home Clean Services Management System Project 1Home Clean Services Management System Jun 17, 2026 May 24, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to...Show more A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to code execution. The attack may be launched remotely but demands an authentication. Exploit details have been disclosed to the public.Show less

Previous 1...165166167...228 Next