← Back
CWE-434

4,557 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

JSON object

Loading...

CVEs (4,557)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-1008
1Ocdi
1One Click Demo Import
Jun 17, 2026
Apr 11, 2022
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disal...Show more
The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowedShow less
CVE-2022-1045
1Trudesk Project
1Trudesk
Jun 17, 2026
Apr 11, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.
CVE-2022-27477
1Newbee Mall Project
1Newbee Mall
Jun 17, 2026
Apr 10, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.
CVE-2022-27131
1Zbzcms
1Zbzcms
Jun 17, 2026
Apr 10, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27129
1Zbzcms
1Zbzcms
Jun 17, 2026
Apr 10, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27047
1Moguit
1Mogu Blog Cms
Jun 17, 2026
Apr 8, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation.
CVE-2021-46367
1Ritecms
1Ritecms
Jun 17, 2026
Apr 8, 2022
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files...Show more
RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default.Show less
CVE-2022-27357
1Ecommerce Website Project
1Ecommerce Website
Jun 17, 2026
Apr 8, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27352
1Simple House Rental System Project
1Simple House Rental System
Jun 17, 2026
Apr 8, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27351
1Phpgurukul
1Zoo Management System
Jun 17, 2026
Apr 8, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27349
1Socialcodia
1Social Codia Sms
Jun 17, 2026
Apr 8, 2022
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27346
1Ecommerce Website Project
1Ecommerce Website
Jun 17, 2026
Apr 8, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27064
1Musical World Project
1Musical World
Jun 17, 2026
Apr 8, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-27061
1Aerocms Project
1Aerocms
Jun 17, 2026
Apr 8, 2022
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2021-43430
1Bigantsoft
1Bigant Office Messenger 5
Jun 17, 2026
Apr 7, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files.
CVE-2021-43421
1Std42
1Elfinder
Jun 17, 2026
Apr 7, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
CVE-2022-26627
1Online Project Time Management System Project
1Online Project Time Management System
Jun 17, 2026
Apr 7, 2022
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file.
CVE-2022-26607
1Baigo
1Baigo Cms
Jul 9, 2026
Apr 6, 2022
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2022-26605
1Dascomsoft
1Eziosuite
Jun 17, 2026
Apr 6, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality.
CVE-2022-26630
1Jellycms
1Jellycms
Jun 17, 2026
Apr 5, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php.