CWE-434

In LimeSurvey before 3.14.7, an admin user can leverage a "file upload" question to read an arbitrary file,

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation.

Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote auth

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a si

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file,

In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file mo

NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes

Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they coul

An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following vers

import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin

Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file,

In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverag

An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the followin

Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code exec

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability.

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which a

Insecure Temporary file vulnerability in /tmp/kamailio_fifo in kamailio 4.0.1.

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image

Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS so

Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http:

Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulner

Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membe

Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to s

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e

Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a cra

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly v

iStock Management System 1.0 allows Arbitrary File Upload via user/profile.

Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site

The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files or process, allowing an attacker t

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper in

Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbi

Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authentica

The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploa

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allo

IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to exec

Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6)

An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createR

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary

In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a fi

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile

OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code

Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbi

In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, whic

Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZI