Filtered by CWE-434
Filtered by vendor Subscriptions
Total 4017 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-29386 2026-04-28 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0.
CVE-2023-29384 1 Hmplugin 1 Jobwp 2026-04-28 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
CVE-2023-29102 1 Olivethemes 1 Olive One Click Demo Import 2026-04-28 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
CVE-2023-28170 1 Themely 1 Theme Demo Import 2026-04-28 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1.
CVE-2023-27440 1 Wordpress 1 Wordpress 2026-04-28 7.2 High
Unrestricted Upload of File with Dangerous Type vulnerability in OnTheGoSystems Types.This issue affects Types: from n/a through 3.4.17.
CVE-2023-25970 1 Zendrop 1 Zendrop 2026-04-28 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
CVE-2023-25444 3 Joomsky, Jshelpdesk, Wordpress 3 Js Help Desk, Jshelpdesk, Wordpress 2026-04-28 9.1 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Using Malicious Files.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.7.
CVE-2023-23970 1 Woorockets 1 Corsa 2026-04-28 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5.
CVE-2023-23656 2026-04-28 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from n/a through 4.1.
CVE-2022-46839 1 Wiselyhub 1 Js Help Desk 2026-04-28 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVE-2022-45377 1 Codedropz 1 Drag And Drop Multiple File Upload For Woocommerce 2026-04-28 6.5 Medium
Unrestricted Upload of File with Dangerous Type vulnerability in Glen Don L. Mongaya Drag and Drop Multiple File Upload for WooCommerce.This issue affects Drag and Drop Multiple File Upload for WooCommerce: from n/a through 1.0.8.
CVE-2026-7238 1 Code-projects 1 Online Music Site 2026-04-28 4.7 Medium
A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulation of the argument txtimage causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2026-28133 2 Wordpress, Wp Chill 2 Wordpress, Filr 2026-04-28 8.5 High
Unrestricted Upload of File with Dangerous Type vulnerability in WP Chill Filr filr-protection allows Upload a Web Shell to a Web Server.This issue affects Filr: from n/a through <= 1.2.14.
CVE-2026-6885 1 Borg Technology Corporation 1 Borg Spm 2007 2026-04-28 9.8 Critical
Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVE-2026-5364 2 Addonsorg, Wordpress 2 Drag And Drop File Upload For Contact Form 7, Wordpress 2026-04-28 8.1 High
The Drag and Drop File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.1.3. This is due to the plugin extracting the file extension before sanitization occurs and allowing the file type parameter to be controlled by the attacker rather than being restricted to administrator-configured values, which when combined with the fact that validation occurs on the unsanitized extension while the file is saved with a sanitized extension, allows special characters like '$' to be stripped during the save process. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and potentially achieve remote code execution, however, an .htaccess file and name randomization is in place which restricts real-world exploitability.
CVE-2026-7134 1 Code-projects 1 Online Lot Reservation System 2026-04-28 4.7 Medium
A vulnerability was identified in code-projects Online Lot Reservation System 1.0. Affected is an unknown function of the file /edithousepic.php. Such manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.
CVE-2026-3844 2 Cloudways, Wordpress 2 Breeze, Wordpress 2026-04-28 9.8 Critical
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
CVE-2026-7107 1 Code-projects 1 Invoice System In Laravel 2026-04-28 6.3 Medium
A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-58963 1 Wordpress 1 Wordpress 2026-04-27 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: from n/a through < 1.1.9.
CVE-2025-67924 1 Wordpress 1 Wordpress 2026-04-27 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload a Web Shell to a Web Server.This issue affects Corpkit: from n/a through <= 2.0.