Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,556)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-23315 1Mingsoft 1Mcms Jun 17, 2026 Jan 21, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.
CVE-2022-22929 1Mingsoft 1Mcms Jun 17, 2026 Jan 21, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
CVE-2021-45808 1Jpress 1Jpress Jul 9, 2026 Jan 19, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server.
CVE-2021-46013 1Free School Management Software Project 1Free School Management Software Jun 17, 2026 Jan 18, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php w...Show more An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "<?php system($_GET["cmd"]); ?>" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users.Show less
CVE-2022-0263 1Pimcore 1Pimcore Jun 17, 2026 Jan 18, 2022 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
CVE-2021-41550 1Leostream 1Connection Broker Jun 17, 2026 Jan 18, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.
CVE-2021-38697 1Softvibe 1Saraban Jun 17, 2026 Jan 18, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.
CVE-2022-0242 1Craterapp 1Crater Jun 17, 2026 Jan 17, 2022 N/A· v4 7.2 HIGH· v3 6.0 MEDIUM· v2 Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
CVE-2021-33828 1Owncloud 1Files Antivirus Jun 17, 2026 Jan 15, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploaded to a public share) are supposed to be deleted upon detection.
CVE-2021-34997 1Commvault 1Commcell Jun 17, 2026 Jan 13, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authenticatio...Show more This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AppStudioUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13894.Show less
CVE-2021-34995 1Commvault 1Commcell Jun 17, 2026 Jan 13, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authenticatio...Show more This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DownloadCenterUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13756.Show less
CVE-2021-45411 1Printable Staff Id Card Creator System Project 1Printable Staff Id Card Creator System Jun 17, 2026 Jan 12, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.
CVE-2021-44651 1Zohocorp 2Log360 Manageengine Cloud Security Plus Jun 17, 2026 Jan 12, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175.
CVE-2021-4080 1Craterapp 1Crater Jun 17, 2026 Jan 12, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 crater is vulnerable to Unrestricted Upload of File with Dangerous Type
CVE-2021-43973 1Sysaid 1Sysaid Jun 17, 2026 Jan 11, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful requ...Show more An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.Show less
CVE-2021-46079 1Vehicle Service Management System Project 1Vehicle Service Management System Jun 17, 2026 Jan 6, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection.
CVE-2021-46078 1Vehicle Service Management System Project 1Vehicle Service Management System Jun 17, 2026 Jan 6, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to a Stored Cross-Site Scripting vulnerability.
CVE-2021-46076 1Vehicle Service Management System Project 1Vehicle Service Management System Jun 17, 2026 Jan 6, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious php file in multiple endpoints it leading to Code Execution.
CVE-2021-44031 1Quest 1Kace Desktop Authority Jun 17, 2026 Dec 22, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code executio...Show more An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.Show less
CVE-2021-24981 1Wpwax 1Directorist Jun 17, 2026 Dec 21, 2021 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.

Previous 1...175176177...228 Next