Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,556)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-23390 1Diyhi 1Bbs Forum Jun 17, 2026 Feb 14, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.
CVE-2021-22803 1Schneider Electric 1Interactive Graphical Scada System Data Collector Jun 17, 2026 Feb 11, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders in context of the DC...Show more A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders in context of the DC module, by sending constructed messages on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)Show less
CVE-2020-13675 1Drupal 1Drupal Jun 17, 2026 Feb 11, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload f...Show more Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.Show less
CVE-2022-23048 1Exponentcms 1Exponent Cms Jun 17, 2026 Feb 9, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/{rce}...Show more Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/{rce}.php" from where can be accessed in order to execute commands.Show less
CVE-2021-37194 1Siemens 1Comos Jun 17, 2026 Feb 9, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web c...Show more A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files.Show less
CVE-2021-46360 1Ocproducts 1Composr Jun 17, 2026 Feb 9, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.
CVE-2022-24676 1Hyphp 1Hybbs2 Jun 17, 2026 Feb 9, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.
CVE-2021-24947 1Thinkupthemes 1Responsive Vector Maps Jun 17, 2026 Feb 7, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, s...Show more The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web serverShow less
CVE-2022-0472 1Laracom Project 1Laracom Jun 17, 2026 Feb 4, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
CVE-2022-23329 1Ujcms 1Jspxcms Jun 17, 2026 Feb 4, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files.
CVE-2022-24262 1Voipmonitor 1Voipmonitor Jun 17, 2026 Feb 4, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.
CVE-2021-46428 1Simple Chatbot Application Project 1Simple Chatbot Application Jun 17, 2026 Jan 27, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avatar parameter in SystemSettings.php.
CVE-2021-46097 1Dolphinphp 1Dolphinphp Jun 17, 2026 Jan 27, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log
CVE-2021-46386 1Mingsoft 1Mcms Jun 17, 2026 Jan 26, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.
CVE-2021-46116 1Jpress 1Jpress Jul 9, 2026 Jan 26, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.
CVE-2021-46115 1Jpress 1Jpress Jul 9, 2026 Jan 26, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.
CVE-2021-44123 1Spip 1Spip Jun 17, 2026 Jan 26, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it.
CVE-2022-23026 1F5 2Big Ip Advanced Web Application Firewall Big Ip Application Acceleration Manager Jun 17, 2026 Jan 25, 2022 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, an authenticated user with low privileges, such as a guest, can upload dat...Show more On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, an authenticated user with low privileges, such as a guest, can upload data using an undisclosed REST endpoint causing an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.Show less
CVE-2021-46033 1Forestblog Project 1Forestblog Jun 17, 2026 Jan 25, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In ForestBlog, as of 2021-12-28, File upload can bypass verification.
CVE-2021-46113 1Kea Hotel Erp Project 1Kea Hotel Erp Jun 17, 2026 Jan 25, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service.

Previous 1...174175176...228 Next