CWE-434— Unrestricted Upload of File with Dangerous Type

CVE-2023-47873CRITICALCVSS 9.1EG 9.1

Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2.

CVE-2023-48031CRITICALCVSS 9.8EG 9.8

Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a through 1.0.9.

2023-11-17

OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an …

CVE-2023-4817HIGHCVSS 7.2EG 7.2

2023-10-03

This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire device.

CVE-2023-48217HIGHCVSS 8.8EG 8.8

2023-11-14

Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-…

CVE-2023-48275HIGHCVSS 8.0EG 8.0

CVE-2023-48371CRITICALCVSS 9.8EG 9.8

Unrestricted Upload of File with Dangerous Type vulnerability in Trustindex.Io Widgets for Google Reviews.This issue affects Widgets for Google Reviews: from n/a through 11.0.2.

2023-12-15

ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary syste…

CVE-2023-48376CRITICALCVSS 9.8EG 9.8

2023-12-15

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to pe…

CVE-2023-48394HIGHCVSS 8.8EG 8.8

2023-12-15

Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary file…

CVE-2023-48777CRITICALCVSS 9.9EG 9.9

CVE-2023-48930CRITICALCVSS 9.8EG 9.8

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.

2023-12-06

xinhu xinhuoa 2.2.1 contains a File upload vulnerability.

CVE-2023-48965HIGHCVSS 8.8EG 8.8

2023-12-04

An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file.

CVE-2023-48966HIGHCVSS 8.8EG 8.8

2023-12-04

An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.

CVE-2023-49052HIGHCVSS 8.8EG 8.8

2023-11-30

File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.

CVE-2023-49257HIGHCVSS 8.8EG 8.8

2024-01-12

An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.

CVE-2023-49715MEDIUMCVSS 4.3EG 4.3

2024-01-10

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an…

CVE-2023-49814CRITICALCVSS 9.1EG 9.1

2023-12-20

Unrestricted Upload of File with Dangerous Type vulnerability in Symbiostock symbiostock.This issue affects Symbiostock: from n/a through 6.0.0.

CVE-2023-49815CRITICALCVSS 10.0EG 10.0

2024-03-27

Unrestricted Upload of File with Dangerous Type vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 5.0.3.

CVE-2023-4988MEDIUMCVSS 6.3EG 6.3

2023-09-15

A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?module=system&action=uploadImg. The manipulation of the argument imgFile leads to unrestricted uploa…

CVE-2023-50038HIGHCVSS 8.8EG 8.8

2023-12-28

There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.

CVE-2023-50104CRITICALCVSS 9.8EG 9.8

CVE-2023-5034MEDIUMCVSS 6.3EG 6.3

ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code.

2023-09-18

A vulnerability classified as problematic was found in SourceCodester My Food Recipe 1.0. This vulnerability affects unknown code of the file index.php of the component Image Upload Handler. The manipulation leads to unrestricted upload. T…

CVE-2023-50386HIGHCVSS 8.8EG 9.0

2024-02-09

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 throu…

CVE-2023-50564HIGHCVSS 8.8EG 8.8

2023-12-14

An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.

CVE-2023-50692HIGHCVSS 8.8EG 8.8

2023-12-28

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.

CVE-2023-50717MEDIUMCVSS 5.7EG 5.7

2024-05-14

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts ca…

CVE-2023-50729HIGHCVSS 8.4EG 8.4

2024-01-15

Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent b…

CVE-2023-50760HIGHCVSS 8.8EG 8.8

2024-01-04

Online Notice Board System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'f' parameter of user/update_profile_pic.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the a…

CVE-2023-50897CRITICALCVSS 9.1EG 9.1

2026-01-05

Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Renamer: from n/a through 5.7.7.

CVE-2023-50922HIGHCVSS 7.2EG 7.2

2024-01-03

An issue was discovered on GL.iNet devices through 4.5.0. Attackers who are able to steal the AdminToken cookie can execute arbitrary code by uploading a crontab-formatted file to a specific directory and waiting for its execution. This af…

CVE-2023-50982CRITICALCVSS 9.0EG 9.0

2024-01-08

Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload_action and edit_action in Admin_SmileysController do not check the file extension. This leads to remote code execution with the privileges of th…

CVE-2023-51034CRITICALCVSS 9.8EG 9.8

2023-12-22

TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface.

CVE-2023-51409CRITICALCVSS 10.0EG 10.0

2024-04-12

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.

CVE-2023-51410CRITICALCVSS 9.9EG 9.9

CVE-2023-51411CRITICALCVSS 10.0EG 10.0

Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log.This issue affects WP Mail Log: from n/a through 1.1.2.

CVE-2023-51412CRITICALCVSS 9.0EG 9.0

Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.

CVE-2023-51417CRITICALCVSS 9.9EG 9.9

Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25.

CVE-2023-51419CRITICALCVSS 10.0EG 10.0

Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.

CVE-2023-51421CRITICALCVSS 9.9EG 9.9

Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.

CVE-2023-5144MEDIUMCVSS 6.3EG 6.3

Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.

2023-09-24

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected is an unknown function of the file /sysmanage/updateos.php. The manipulation of the argum…

CVE-2023-51444HIGHCVSS 7.2EG 7.2

2024-03-20

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file upload vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrat…

CVE-2023-5145MEDIUMCVSS 6.3EG 6.3

CVE-2023-5146MEDIUMCVSS 6.3EG 6.3

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000 up to 20151231 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmanage/licence.php. The manipulation of…

CVE-2023-51468CRITICALCVSS 10.0EG 10.0

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulatio…

CVE-2023-5147MEDIUMCVSS 6.3EG 6.3

Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

CVE-2023-51473CRITICALCVSS 10.0EG 10.0

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20151231. It has been classified as critical. This affects an unknown part of the file /sysmanage/updateos.php. The manipulation of the argument 1_file_uplo…

CVE-2023-51475CRITICALCVSS 10.0EG 10.0

Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.

CVE-2023-5148MEDIUMCVSS 6.3EG 6.3

Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.

CVE-2023-5149MEDIUMCVSS 6.3EG 6.3

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the a…