CWE-434

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo

Upload of Code Without Integrity Check vulnerability in firmware archive of Secomea GateManager allows authenticated att

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.

UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted

The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in

PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.

Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of

An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to th

In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.

IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system,

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability.

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody

Parameter manipulation can bypass authentication to cause file upload and execution. This will execute the remote code.

An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema pars

An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a cr

Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter o

ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file

An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted

An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3_805 devices. An attacker can upload arbitrary file content as a firm

Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files w

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of

There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper veri

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploade

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leadi

The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can b

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlMana

Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1

Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. A

An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacke

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded fee

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly chec

Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_setting

The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported fi

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload a

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly c

The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing h

A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0. If a

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rena

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.

File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not veri

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write

Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/up

Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a rem

An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file

An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg fi