CWE-434

Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary co

BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload

Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sen

Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability

WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.

Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before buil

Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.

controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by

Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5

dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery

The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by upload

A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arb

YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability

NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.

TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.

Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote

IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script.

An unauthenticated file upload vulnerability has been identified in admin_add.php in PHPGurukul Online Book Store 1.0. T

An unauthenticated file upload vulnerability has been identified in admin/gallery.php in PHPGurukul Job Portal 1.0. The

Lexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary commands by uploading file

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 20

Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed

LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitr

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).

Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytec

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability w

In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. As a re

SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additiona

In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value. As

An issue was discovered in AnchorFree VPN SDK before 1.3.3.218. The VPN SDK service takes certain executable locations o

A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP f

An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows arbitrary application execution via an embedded exec

The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Uploa

The install_from_hash functionality in Navigate CMS 2.9 does not consider the .phtml extension when examining files with

File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regul

Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects Worl

Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows a

A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote

ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magi

Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface

Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers

An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an atta

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the use

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmwa

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can up