Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,556)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-24960 1Iptanus 2Wordpress File Upload Wordpress File Upload Pro Jun 17, 2026 Mar 7, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploadin...Show more The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacksShow less
CVE-2021-24216 1Servmask 1One Stop Wp Migration Jun 17, 2026 Mar 7, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations.
CVE-2022-25115 1Home Owners Collection Management System Project 1Home Owners Collection Management System Jun 17, 2026 Mar 2, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file.
CVE-2022-25016 1Home Owners Collection Management System Project 1Home Owners Collection Management System Jun 17, 2026 Mar 2, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary cod...Show more Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.Show less
CVE-2022-24254 1Extensis 1Portfolio Jul 9, 2026 Mar 1, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
CVE-2022-24253 1Extensis 1Portfolio Jul 9, 2026 Mar 1, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransferServlet.
CVE-2022-24252 1Extensis 1Portfolio Jul 9, 2026 Mar 1, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
CVE-2022-24251 1Extensis 1Portfolio Jul 9, 2026 Mar 1, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function.
CVE-2022-25411 1Max 3000 1Maxsite Cms Jun 17, 2026 Feb 28, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-23906 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Feb 28, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.
CVE-2022-26149 1Modx 1Revolution Jun 17, 2026 Feb 26, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
CVE-2021-44664 1Xerte 1Xerte Jun 17, 2026 Feb 24, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a lang...Show more An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.Show less
CVE-2022-25360 1Watchguard 1Fireware Jun 17, 2026 Feb 24, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1...Show more WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.Show less
CVE-2022-23043 1Tribalsystems 1Zenario Jun 17, 2026 Feb 24, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the reques...Show more Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.Show less
CVE-2021-44967 1Limesurvey 1Limesurvey Jun 17, 2026 Feb 24, 2022 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position...Show more A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding.Show less
CVE-2022-24553 1Zfaka Project 1Zfaka Jun 17, 2026 Feb 21, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution.
CVE-2022-23375 1Wikidocs 1Wikidocs Jun 17, 2026 Feb 19, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php.
CVE-2022-0409 1Showdoc 1Showdoc Jun 17, 2026 Feb 19, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
CVE-2021-46036 1Mingsoft 1Mcms Jun 17, 2026 Feb 18, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVE-2022-24984 1Jqueryform 1Jqueryform Jun 17, 2026 Feb 16, 2022 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-ext...Show more Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked.Show less

Previous 1...173174175...228 Next