CWE-434

Unrestricted Upload of File with Dangerous Type

BaseDraftLikelihood: Medium

Description

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Hierarchy (View 1000)

Parents

CWE-669

Children

none

Related attack patterns (CAPEC)

CAPEC-1

CVEs mapped to this weakness (1,669)

page 19 of 84

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-9108	WordPress Wechat Social Login	Cri	0.64	9.8	0.01	Oct 1, 2024	The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_local' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload…
CVE-2024-41577	Senviel Learun Upload File	Cri	0.64	9.8	0.01	Aug 12, 2024	An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVE-2024-37424	Automattic Newspack	Cri	0.64	9.9	0.00	Jul 9, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8.
CVE-2024-37420	Wpzita Zita Elementor Site Library	Cri	0.64	9.9	0.00	Jul 9, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1.
CVE-2024-37418	Church Admin Project Church Admin	Cri	0.64	9.9	0.01	Jul 9, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.
CVE-2024-35527	Farcrycore Farcry Core	Cri	0.64	9.8	0.01	Jun 25, 2024	An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file.
CVE-2024-33836	JA Module JA Marketplace	Cri	0.64	9.8	0.00	Jun 19, 2024	In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X, the method `JmarketplaceproductModuleFrontController::init()` and in version 8.X, the method…
CVE-2024-3912	Netcore routers	Cri	0.64	9.8	0.01	Jun 14, 2024	Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
CVE-2024-34411	WordPress Canvasio3d Light	Cri	0.64	9.9	0.01	May 14, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in Thomas Scholl canvasio3D Light.This issue affects canvasio3D Light: from n/a through 2.5.0.
CVE-2024-33786	Zhongcheng Kexin Ticketing Management Platform	Cri	0.64	9.8	0.01	May 3, 2024	An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2023-31090	Unlimited Elements Unlimited Elements For Elementor	Cri	0.64	9.9	0.01	Apr 24, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Upload a Web Shell to a Web Server.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates):…
CVE-2024-32514	Infotheme Wp Poll Maker	Cri	0.64	9.9	0.01	Apr 17, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.4.
CVE-2024-31286	WordPress Wp Photo Album Plus	Cri	0.64	9.9	0.01	Apr 7, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a before 8.6.03.005.
CVE-2024-31280	Church Admin Project Church Admin	Cri	0.64	9.9	0.01	Apr 7, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.
CVE-2024-30500	Cubewp Cubewp	Cri	0.64	9.9	0.01	Mar 29, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12.
CVE-2024-29135	Themefic Tourfic	Cri	0.64	9.9	0.01	Mar 19, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.
CVE-2024-25909	Joomunited Wp Media Folder	Cri	0.64	9.9	0.01	Feb 26, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
CVE-2023-6675	National Keep Cyber Security Services Cybermath	Cri	0.64	9.8	0.01	Feb 2, 2024	Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server. This issue affects CyberMath: from v.1.4 before v.1.5.
CVE-2023-51421	Soft8soft Verge3d	Cri	0.64	9.9	0.01	Dec 29, 2023	Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.
CVE-2023-51417	Jorisvm Jvm Gutenberg Rich Text Icons	Cri	0.64	9.9	0.01	Dec 29, 2023	Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.

CVE-2024-9108CriOct 1, 2024
WordPress
Wechat Social Login
risk 0.64cvss 9.8epss 0.01
The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_local' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload…
CVE-2024-41577CriAug 12, 2024
Senviel
Learun Upload File
risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVE-2024-37424CriJul 9, 2024
Automattic
Newspack
risk 0.64cvss 9.9epss 0.00
Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8.
CVE-2024-37420CriJul 9, 2024
Wpzita
Zita Elementor Site Library
risk 0.64cvss 9.9epss 0.00
Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1.
CVE-2024-37418CriJul 9, 2024
Church Admin Project
Church Admin
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.
CVE-2024-35527CriJun 25, 2024
Farcrycore
Farcry Core
risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file.
CVE-2024-33836CriJun 19, 2024
JA Module
JA Marketplace
risk 0.64cvss 9.8epss 0.00
In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X, the method `JmarketplaceproductModuleFrontController::init()` and in version 8.X, the method…
CVE-2024-3912CriJun 14, 2024
Netcore
routers
risk 0.64cvss 9.8epss 0.01
Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands on the device.
CVE-2024-34411CriMay 14, 2024
WordPress
Canvasio3d Light
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Thomas Scholl canvasio3D Light.This issue affects canvasio3D Light: from n/a through 2.5.0.
CVE-2024-33786CriMay 3, 2024
Zhongcheng Kexin
Ticketing Management Platform
risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2023-31090CriApr 24, 2024
Unlimited Elements
Unlimited Elements For Elementor
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Upload a Web Shell to a Web Server.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates):…
CVE-2024-32514CriApr 17, 2024
Infotheme
Wp Poll Maker
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker.This issue affects WP Poll Maker: from n/a through 3.4.
CVE-2024-31286CriApr 7, 2024
WordPress
Wp Photo Album Plus
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a before 8.6.03.005.
CVE-2024-31280CriApr 7, 2024
Church Admin Project
Church Admin
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.
CVE-2024-30500CriMar 29, 2024
Cubewp
Cubewp
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12.
CVE-2024-29135CriMar 19, 2024
Themefic
Tourfic
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.
CVE-2024-25909CriFeb 26, 2024
Joomunited
Wp Media Folder
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2.
CVE-2023-6675CriFeb 2, 2024
National Keep Cyber Security Services
Cybermath
risk 0.64cvss 9.8epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server. This issue affects CyberMath: from v.1.4 before v.1.5.
CVE-2023-51421CriDec 29, 2023
Soft8soft
Verge3d
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.
CVE-2023-51417CriDec 29, 2023
Jorisvm
Jvm Gutenberg Rich Text Icons
risk 0.64cvss 9.9epss 0.01
Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.