Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CVEs (4,107)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-15862 1Cksource 1Ckfinder Jun 17, 2026 Sep 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the application was configured to accept files only with a defined...Show more An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any extension (even if the application was configured to accept files only with a defined set of extensions). This affects CKFinder for ASP, CKFinder for ASP.NET, CKFinder for ColdFusion, and CKFinder for PHP.Show less
CVE-2019-16720 1Zzzcms 1Zzzphp Jun 17, 2026 Sep 23, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
CVE-2015-9402 1Usersultra 1Users Ultra Membership Nov 21, 2024 Sep 20, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
CVE-2019-14916 1Prise 1Adas Jun 17, 2026 Sep 20, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file upload.
CVE-2019-14252 1Publisure 1Publisure Jun 17, 2026 Sep 18, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, one is able to inject arbitrary PHP code by using the adminCons.php form. The code is then stored in t...Show more An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, one is able to inject arbitrary PHP code by using the adminCons.php form. The code is then stored in the E:\PUBLISURE\webservice\webpages\AdminDir\Templates\ folder even if removed from the adminCons.php view (i.e., the rogue PHP file can be hidden).Show less
CVE-2019-15843 1Mi 1Xiaomi Millet Firmware Jun 17, 2026 Sep 18, 2019 N/A· v4 7.4 HIGH· v3 5.8 MEDIUM· v2 A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may lead to partial data leakage or malicious file writing.
CVE-2016-10995 1Templatic 1Telvolution Nov 21, 2024 Sep 18, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
CVE-2019-6839 1Schneider Electric 4Meg6260 0410 Firmware Meg6260 0415 FirmwareMeg6501 0001 Firmware+1 more Jun 17, 2026 Sep 17, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, To...Show more A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow a user with low privileges to upload a rogue file.Show less
CVE-2019-15131 1Code42 1Code42 Jun 17, 2026 Sep 17, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an a...Show more In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42 servers, which could potentially lead to code execution.Show less
CVE-2019-8371 1Open Emr 1Openemr Jun 17, 2026 Sep 16, 2019 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 OpenEMR v5.0.1-6 allows code execution.
CVE-2016-10959 1Estatik 1Estatik Nov 21, 2024 Sep 16, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
CVE-2016-10958 1Estatik 1Estatik Nov 21, 2024 Sep 16, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
CVE-2019-16318 1Pimcore 1Pimcore Jun 17, 2026 Sep 14, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filename...Show more In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.Show less
CVE-2016-10955 1Cysteme 1Cysteme Finder Nov 21, 2024 Sep 13, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
CVE-2016-10954 1Dynamicpress 1Neosense Nov 21, 2024 Sep 13, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
CVE-2019-16192 1Doccms 1Doccms Jun 17, 2026 Sep 9, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.
CVE-2019-16131 1Phpok 1Oklite Jun 17, 2026 Sep 9, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/cache/.
CVE-2019-13187 1Symphonyextensions 1Rich Text Formatter Jun 17, 2026 Sep 5, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in content.fileupload.php and content.imageupload.php.
CVE-2019-13976 1Egain 1Chat Jun 17, 2026 Sep 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 eGain Chat 15.0.3 allows unrestricted file upload.
CVE-2019-15813 1Sentrifugo 1Sentrifugo Jun 17, 2026 Sep 4, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.

Previous 1...183184185...206 Next