CWE-434

A security vulnerability has been detected in Metasoft 美特软件 MetaCRM 6.4.0. The impacted element is an unknown function o

A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PH

A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file applicati

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versi

A security vulnerability has been detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a

The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php ma

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. I

A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unkn

A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by th

A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this is

A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d4

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dial

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown function

AnMing MP3 CD Burner 2.0 contains a buffer overflow vulnerability that allows local attackers to crash the application b

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files wi

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST

The a+HCM developed by aEnrich has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions),

NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers

HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicio

A vulnerability was identified in kalcaddle kodbox 1.64. This issue affects the function Add of the file app/controller/

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form

IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to m

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 con

Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files wi

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor

Horilla is a free and open source Human Resource Management System (HRMS). In versions prior to 1.5.0, a cross-site scri

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Con

An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows atta

Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied C

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limi

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excess

An arbitrary file overwrite vulnerability in RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos v1.0.135 al

The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only re

Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within t

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to buil

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows upl