Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.

CVE-2022-28120CRITICALCVSS 9.8EG 9.8

2022-05-05

Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server.

CVE-2022-28223CRITICALCVSS 9.1EG 7.2

2022-03-30

Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.

CVE-2022-28369CRITICALCVSS 9.8EG 9.8

2022-07-14

Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote atta…

CVE-2022-28372HIGHCVSS 7.5EG 7.5

2022-07-14

On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL pr…

CVE-2022-28397CRITICALCVSS 9.8EG 9.8

2022-04-12

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploa…

CVE-2022-28440HIGHCVSS 8.8EG 8.8

2022-04-21

An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-28525HIGHCVSS 8.8EG 8.8

2022-04-26

ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_user&id=1.

CVE-2022-28528HIGHCVSS 8.8EG 8.8

2022-04-26

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit.

CVE-2022-28568CRITICALCVSS 9.8EG 9.8

2022-05-04

Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored.

CVE-2022-28606CRITICALCVSS 9.8EG 9.8

2022-05-05

An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server.

CVE-2022-28695HIGHCVSS 7.2EG 7.2

2022-05-05

On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, an authenticated attacker with high privileges can upload a maliciously crafted …

CVE-2022-28700CRITICALCVSS 9.1EG 7.2

2022-07-21

Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

CVE-2022-2872MEDIUMCVSS 5.4EG 5.4

2022-09-21

Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.

CVE-2022-2883HIGHCVSS 7.5EG 7.5

2023-02-22

In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service

CVE-2022-28863HIGHCVSS 8.8EG 8.8

2023-07-24

An issue was discovered in Nokia NetAct 22. A remote user, authenticated to the website, can visit the Site Configuration Tool section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir paramete…

CVE-2022-28927CRITICALCVSS 9.8EG 9.8

2022-05-19

A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.

CVE-2022-29001HIGHCVSS 7.2EG 7.2

2022-05-03

In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability

CVE-2022-2909MEDIUMCVSS 6.3EG 8.8

2022-08-20

A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /mkshop/Men/profile.php. The manipulation leads to u…

CVE-2022-29318HIGHCVSS 7.2EG 7.2

2022-05-11

An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-29347CRITICALCVSS 9.8EG 9.8

2022-05-04

An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.

CVE-2022-29351CRITICALCVSS 9.8EG 9.8

2022-05-16

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerabi…

CVE-2022-29353CRITICALCVSS 9.8EG 9.8

2022-05-16

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename.

CVE-2022-29354CRITICALCVSS 9.8EG 9.8

2022-05-16

An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file.

CVE-2022-29451HIGHCVSS 8.8EG 8.8

2022-04-29

Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/upl…

CVE-2022-29464CRITICALCVSS 9.8EG 9.8⚠ KEV

2022-04-18

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such a…

CVE-2022-29622CRITICALCVSS 9.8EG 9.8

2022-05-16

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrar…

CVE-2022-29623HIGHCVSS 7.8EG 7.8

2022-05-16

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report.

CVE-2022-29624HIGHCVSS 8.8EG 8.8

2022-06-02

An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-29632CRITICALCVSS 9.8EG 9.8

2022-05-26

An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file.

CVE-2022-29637HIGHCVSS 7.8EG 7.8

2022-05-26

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.

CVE-2022-29651HIGHCVSS 7.2EG 7.2

2022-05-25

An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-29655HIGHCVSS 7.2EG 7.2

2022-05-11

An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-29725HIGHCVSS 8.8EG 8.8

2022-06-02

An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-30007HIGHCVSS 7.2EG 7.2

2022-05-17

GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.

CVE-2022-30216HIGHCVSS 8.8EG 8.8

2022-07-12

Windows Server Service Tampering Vulnerability

CVE-2022-30423CRITICALCVSS 9.8EG 9.8

2022-06-02

Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information.

CVE-2022-30448CRITICALCVSS 9.8EG 9.8

2022-05-11

Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php.

CVE-2022-30506CRITICALCVSS 9.8EG 9.8

2022-06-02

An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.

CVE-2022-30529HIGHCVSS 7.2EG 7.2

2022-11-22

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/applicati…

CVE-2022-3076HIGHCVSS 7.2EG 7.2

2022-09-26

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP …

CVE-2022-30808CRITICALCVSS 9.8EG 9.8

2022-06-02

elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.

CVE-2022-30819HIGHCVSS 8.8EG 8.8

2022-06-02

In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.

CVE-2022-30820HIGHCVSS 8.8EG 8.8

2022-06-02

In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file.

CVE-2022-30821HIGHCVSS 8.8EG 8.8

2022-06-02

In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability in the picture upload point of "package_edit.php" file.

CVE-2022-30822HIGHCVSS 8.8EG 8.8

2022-06-02

In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file.

CVE-2022-30860HIGHCVSS 7.2EG 7.2

2022-06-06

FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.

CVE-2022-30887CRITICALCVSS 9.8EG 9.8

2022-05-20

Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted image fil…

CVE-2022-31041HIGHCVSS 7.6EG 7.6

2022-06-13

Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. o…

CVE-2022-31086HIGHCVSS 8.8EG 8.8

2022-06-27

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. T…

CWE-434— Unrestricted Upload of File with Dangerous Type

CVEs classified under CWE-434page 28 of 79

Map vulnerabilities like CWE-434 to your infrastructure