Filtered by CWE-434
Filtered by vendor Subscriptions
Total 4028 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-3257 1 Mattermost 1 Mattermost Server 2024-12-07 3.1 Low
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
CVE-2023-27083 1 Pluck-cms 1 Pluck 2024-12-07 7.2 High
An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.
CVE-2022-44276 1 Tecrail 1 Responsive Filemanager 2024-12-05 9.8 Critical
In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
CVE-2023-34736 1 Guantang Equipment Management System Project 1 Guantang Equipment Management System 2024-12-05 7.2 High
Guantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload.
CVE-2023-32525 1 Trendmicro 1 Mobile Security 2024-12-05 6.5 Medium
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32526.
CVE-2024-51548 1 Abb 3 Aspect Enterprise, Matrix Series, Nexus Series 2024-12-05 9.9 Critical
Dangerous File Upload vulnerabilities allow upload of malicious scripts.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
CVE-2024-11674 2 Codeastro, Hospital Management System Project 2 Hospital Management System, Hospital Management System 2024-12-04 6.3 Medium
A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/his_doc_update-account.php. The manipulation of the argument doc_dpic leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-11661 1 Codezips 1 Free Exam Hall Seating Management System 2024-12-04 4.3 Medium
A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file profile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The researcher submit confuses the vulnerability class of this issue.
CVE-2023-32526 1 Trendmicro 1 Mobile Security 2024-12-04 6.5 Medium
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32525.
CVE-2023-32621 1 Wavlink 2 Wl-wn531ax2, Wl-wn531ax2 Firmware 2024-12-04 7.2 High
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.
CVE-2024-11971 1 Jpress 1 Jpress 2024-12-03 3.5 Low
A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-33404 1 Blogengine 1 Blogengine.net 2024-12-03 9.8 Critical
An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.
CVE-2023-4223 1 Chamilo 1 Chamilo Lms 2024-12-02 8.8 High
Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
CVE-2023-39548 1 Nec 2 Expresscluster X, Expresscluster X Singleserversafe 2024-12-02 8.8 High
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
CVE-2023-36097 1 Funadmin 1 Funadmin 2024-12-02 9.8 Critical
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
CVE-2018-0258 1 Cisco 2 Prime Data Center Network Manager, Prime Infrastructure 2024-11-29 N/A
A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device (aka Path Traversal) and execute those files. This vulnerability affects the following products: Cisco Prime Data Center Network Manager (DCNM) Version 10.0 and later, and Cisco Prime Infrastructure (PI) All versions. Cisco Bug IDs: CSCvf32411, CSCvf81727.
CVE-2023-1721 1 Yoga Class Registration System Project 1 Yoga Class Registration System 2024-11-27 9.1 Critical
Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.
CVE-2023-36630 1 Mgt-commerce 1 Cloudpanel 2024-11-27 8.8 High
In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
CVE-2020-20210 1 Bludit 1 Bludit 2024-11-27 8.8 High
Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.
CVE-2023-34833 1 Thinkadmin 1 Thinkadmin 2024-11-27 6.1 Medium
An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arbitrary code via a crafted file.