VYPR

CWE-434

Unrestricted Upload of File with Dangerous Type

BaseDraftLikelihood: Medium

Description

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-1

CVEs mapped to this weakness (1,669)

page 11 of 84
  • CVE-2023-23656CriMar 26, 2024
    WordPress
    Mainwp File Uploader Extension
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from n/a through 4.1.

  • CVE-2024-27957CriMar 17, 2024
    Genetechsolutions
    Pie Register
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1.

  • CVE-2024-25925CriFeb 26, 2024
    Sysbasics
    Easy Checkout Field Editor
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Discounts.This issue affects WooCommerce Easy Checkout Field Editor, Fees & Discounts: from n/a through 3.5.12.

  • CVE-2024-25913CriFeb 26, 2024
    Skymoonlabs
    Moveto
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

  • CVE-2023-52221CriJan 24, 2024
    Ukrsolution
    Barcode Scanner And Inventory Manager
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in UkrSolution Barcode Scanner and Inventory manager.This issue affects Barcode Scanner and Inventory manager: from n/a through 1.5.1.

  • CVE-2022-46839CriJan 5, 2024
    Joomsky
    Js Help Desk
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.

  • CVE-2023-51475CriDec 29, 2023
    WordPress
    WP MLM SOFTWARE PLUGIN
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN.This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.

  • CVE-2023-51473CriDec 29, 2023
    Pixelemu
    Terraclassifieds
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin.This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.

  • CVE-2023-51468CriDec 29, 2023
    WordPress
    Rencontre
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.10.1.

  • CVE-2023-51419CriDec 29, 2023
    Bertha
    Bertha AI
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome.This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.

  • CVE-2023-51411CriDec 29, 2023
    Dynamiapps
    Frontend Admin
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.

  • CVE-2023-29384CriDec 20, 2023
    WordPress
    Jobwp
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.

  • CVE-2018-16287CriSep 14, 2018
    LG
    SuperSign CMS
    risk 0.65cvss 9.8epss 0.20

    LG SuperSign CMS allows file upload via signEzUI/playlist/edit/upload/..%2f URIs.

  • CVE-2018-11091CriMay 14, 2018
    MyBiz
    MyProcureNet
    risk 0.65cvss 9.9epss 0.04

    An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload a script to issue operating system commands. This vulnerability occurs because an attacker is able to adjust the…

  • CVE-2018-10942CriMay 10, 2018
    Prestashop
    Attribute Wizard
    risk 0.65cvss 9.8epss 0.13

    modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file.

  • CVE-2017-18048HigJan 23, 2018
    Monstra
    Monstra
    risk 0.65cvss 8.8epss 0.64

    Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.

  • CVE-2017-9080HigMay 19, 2017
    Playsms
    Playsms
    risk 0.65cvss 8.8epss 0.62

    PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.

  • CVE-2026-40750CriJun 16, 2026
    WordPress
    Kids Online Store
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.

  • CVE-2026-39591CriJun 15, 2026
    WordPress
    Wp Businessdirectory
    risk 0.64cvss 9.9epss 0.00

    Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

  • CVE-2026-50873CriJun 15, 2026
    Flatnotes
    Flatnotes
    risk 0.64cvss 9.8epss 0.00

    An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file.