Filtered by CWE-434
Filtered by vendor Subscriptions
Total 4026 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-66250 1 Dbbroadcast 45 Mozart Dds Next 100, Mozart Dds Next 1000, Mozart Dds Next 1000 Firmware and 42 more 2025-12-03 9.8 Critical
Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.
CVE-2025-51736 1 Hcltech 1 Unica 2025-12-02 6.3 Medium
File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.
CVE-2025-13573 1 Projectworlds 2 Advanced Library Management System, Can Pass Malicious Payloads 2025-12-02 6.3 Medium
A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php. The manipulation of the argument image results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
CVE-2025-13574 2 Code-projects, Fabian 2 Online Bidding System, Online Bidding System 2025-12-02 4.7 Medium
A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.php. This manipulation of the argument catimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-63601 1 Snipeitapp 1 Snipe-it 2025-12-01 9.9 Critical
Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.
CVE-2025-63748 2 Qatraq, Testmanagement 2 Qatraq, Qatraq 2025-11-26 8.8 High
QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restrict file types, enabling the upload of executable PHP files. Once uploaded, the file can be accessed through the "View Attachment" option, which executes the PHP payload on the server.
CVE-2025-7063 2 Pad, Widzialni 2 Pad Cms, Pad Cms 2025-11-26 9.8 Critical
Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVE-2025-7065 2 Pad, Widzialni 2 Pad Cms, Pad Cms 2025-11-26 9.8 Critical
Due to client-controlled permission check parameter, PAD CMS's photo upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVE-2025-8120 2 Pad, Widzialni 2 Pad Cms, Pad Cms 2025-11-26 9.8 Critical
Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
CVE-2024-8164 1 Beikeshop 2 Beikeshop, Chengdu Everbrite Network Technology 2025-11-24 6.3 Medium
A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controllers/FileManagerController.php. This manipulation of the argument new_name causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.6.0 is able to mitigate this issue. The affected component should be upgraded.
CVE-2025-13185 2 Bdtask, Codecanyon 2 News365, News365 2025-11-22 4.7 Medium
A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3. This affects an unknown function of the file /admin/dashboard/profile. The manipulation of the argument profile_image/banner_image results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-41735 2 Metz-connect, Metz Connect 7 Ewio2-bm, Ewio2-bm Firmware, Ewio2-m and 4 more 2025-11-21 8.8 High
A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.
CVE-2025-64176 2 Matiasdesuu, Thinkdashboard Project 2 Thinkdashboard, Thinkdashboard 2025-11-21 5.3 Medium
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8.
CVE-2025-7895 1 Harry0703 1 Moneyprinterturbo 2025-11-21 6.3 Medium
A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file app/controllers/v1/video.py of the component File Extension Handler. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely.
CVE-2025-63695 1 Dzzoffice 1 Dzzoffice 2025-11-20 9.8 Critical
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
CVE-2024-3508 1 Redhat 1 Trusted Profile Analyzer 2025-11-20 4.3 Medium
A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.
CVE-2023-41506 1 Code-projects 1 Student Enrollment 2025-11-20 9.8 Critical
An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2021-25780 1 Janobe 1 Baby Care System 2025-11-18 7.2 High
An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell.
CVE-2025-2396 1 Edetw 1 U-office Force 2025-11-18 8.8 High
The U-Office Force from e-Excellence has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVE-2025-34222 1 Vasion 2 Virtual Appliance Application, Virtual Appliance Host 2025-11-18 9.1 Critical
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose four admin routes – /admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, and /admin/certs/serviceclients/{scid} – without any authentication check. The routes are defined in the /var/www/app/routes/web.php file inside the printercloud/pi Docker container and are handled by the HPCertificateController class, which performs no user validation. An unauthenticated attacker can therefore upload a new TLS/SSL certificate replacing the trusted root used by the appliance, delete an existing certificate causing immediate loss of trust for services that rely on it, or download any stored CA or client certificate via the service‑clients endpoint which also suffers an IDOR that allows enumeration of all client IDs. This vulnerability has been identified by the vendor as: V-2024-028 — Unauthenticated Admin APIs Used to Modify SSL Certificates.