← Back
CWE-434

4,211 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

JSON object

Loading...

CVEs (4,211)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-9840
1Dolibarr
1Dolibarr
May 13, 2026
Jun 25, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.
CVE-2017-4990
1Emc
1Avamar Server
May 13, 2026
Jun 21, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any d...Show more
In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory which could allow the attacker to execute arbitrary code on the Avamar Server system.Show less
CVE-2017-9380
1Open Emr
1Openemr
May 13, 2026
Jun 2, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.
CVE-2017-9364
1Bigtreecms
1Bigtree Cms
May 13, 2026
Jun 2, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.
CVE-2015-4455
1Aviary Image Editor Add On For Gravity Forms Project
1Aviary Image Editor Add On For Gravity Forms
May 13, 2026
May 23, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with a...Show more
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.Show less
CVE-2017-9101
1Playsms
1Playsms
May 13, 2026
May 21, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
CVE-2017-9080
1Playsms
1Playsms
May 13, 2026
May 19, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.
CVE-2017-6027
1Codesys
1Web Server
May 13, 2026
May 19, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affe...Show more
An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A specially crafted web server request may allow the upload of arbitrary files (with a dangerous type) to the CODESYS Web Server without authorization which may allow remote code execution.Show less
CVE-2017-9069
1Modx
1Modx Revolution
May 13, 2026
May 18, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.
CVE-2017-8080
1Atlassian
1Hipchat Server
May 13, 2026
May 5, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads.
CVE-2017-7989
1Joomla
1Joomla
May 13, 2026
Apr 25, 2017
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate MIME type checks allowed low-privilege users to upload swf files even if they were explicitly forbidden.
CVE-2017-7357
1Atlassian
1Hipchat Server
May 13, 2026
Apr 14, 2017
N/A· v4
9.1 CRITICAL· v3
6.5 MEDIUM· v2
Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file.
CVE-2016-1713
1Vtiger
1Vtiger Crm
May 13, 2026
Apr 14, 2017
N/A· v4
7.3 HIGH· v3
8.5 HIGH· v2
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arb...Show more
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000.Show less
CVE-2017-7281
1Unitrends
1Enterprise Backup
May 13, 2026
Apr 12, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated us...Show more
An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a randomly named file on disk with a user-controlled extension, contents, and path, leading to remote code execution, aka Unrestricted File Upload.Show less
CVE-2017-7695
1Bigtreecms
1Bigtree Cms
May 13, 2026
Apr 11, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
CVE-2016-8973
1Ibm
1Rational Rhapsody Design Manager
May 13, 2026
Mar 20, 2017
N/A· v4
4.3 MEDIUM· v3
4.0 MEDIUM· v2
IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. IBM Reference #: 1999960.
CVE-2015-3884
1Qdpm
1Qdpm
May 13, 2026
Mar 17, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by up...Show more
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.Show less
CVE-2017-6104
1Zen Mobile App Native Project
1Zen Mobile App Native
May 13, 2026
Mar 2, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
CVE-2016-6104
1Ibm
1Security Key Lifecycle Manager
May 13, 2026
Feb 7, 2017
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the...Show more
IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system.Show less
CVE-2016-8921
1Ibm
1Filenet Workplace Xt
May 13, 2026
Feb 1, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.