Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,558)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-1811 1Publify Project 1Publify Jun 17, 2026 May 23, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.
CVE-2022-1752 1Trudesk Project 1Trudesk Jun 17, 2026 May 21, 2022 N/A· v4 8.0 HIGH· v3 6.0 MEDIUM· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.
CVE-2022-30887 1Pharmacy Management System Project 1Pharmacy Management System Jun 17, 2026 May 20, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via...Show more Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file.Show less
CVE-2022-28104 1Foxit 1Pdf Editor Jun 17, 2026 May 20, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.
CVE-2022-28927 1Subconverter Project 1Subconverter Jun 17, 2026 May 19, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.
CVE-2021-41938 1Shopxo 1Shopxo Jun 17, 2026 May 19, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations.
CVE-2022-22482 1Ibm 1Sterling B2b Integrator Jun 17, 2026 May 17, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to upload files that could fill up the filesystem and cause a denial of service. IBM X-Fo...Show more IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to upload files that could fill up the filesystem and cause a denial of service. IBM X-Force ID: 225977.Show less
CVE-2022-30007 1Gxcms Project 1Gxcms Jun 17, 2026 May 17, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control th...Show more GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.Show less
CVE-2022-1409 1Vikwp 1Hotel Booking Engine & Pms Jun 17, 2026 May 16, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malic...Show more The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP codeShow less
CVE-2022-1103 1Advanced Uploader Project 1Advanced Uploader Jun 17, 2026 May 16, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE
CVE-2021-25119 1Wpsocket 1Automatic Grid Image Listing Jun 17, 2026 May 16, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like...Show more The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCEShow less
CVE-2022-29623 1Connect Multiparty Project 1Connect Multiparty Jun 17, 2026 May 16, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerabili...Show more An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report.Show less
CVE-2022-29622 1Formidable Project 1Formidable Jun 17, 2026 May 16, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which...Show more An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.Show less
CVE-2022-29354 1Keystonejs 1Keystone Jun 17, 2026 May 16, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-29353 1Graphql Upload Project 1Graphql Upload Jun 17, 2026 May 16, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename.
CVE-2022-29351 1Tiddlywiki 1Tiddlywiki5 Jul 9, 2026 May 16, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and th...Show more An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here.Show less
CVE-2021-33009 1Myscada 1Mypro Jun 17, 2026 May 13, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.
CVE-2021-42967 1Xxyopen 1Novel Plus Jun 17, 2026 May 13, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files.
CVE-2021-27771 1Hcltech 1Sametime Jun 17, 2026 May 12, 2022 N/A· v4 7.6 HIGH· v3 6.5 MEDIUM· v2 User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containin...Show more User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.Show less
CVE-2022-21809 1Inhandnetworks 1Inrouter302 Firmware Jun 17, 2026 May 12, 2022 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file t...Show more A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.Show less

Previous 1...166167168...228 Next