CWE-434

4,226 vulnerabilities with CWE-434

CVE-2026-40262 HIGH

Note Mark has Stored XSS via Unrestricted Asset Upload

CVSS 8.7

CVE-2026-33435 HIGH

Weblate: Remote code execution during backup restoration

CVSS 8.0

CVE-2026-1555 CRITICAL

WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload

CVSS 9.8

CVE-2026-38526 CRITICAL

Webkul Krayin CRM 2.2.x - Authenticated RCE

CVSS 9.9

CVE-2026-40040 HIGH

Pachno 1.0.6 Unrestricted File Upload Remote Code Execution

CVSS 8.8

CVE-2026-30804 HIGH

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

CVSS 7.2

CVE-2026-33704 HIGH

Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint

CVSS 7.1

CVE-2026-32931 HIGH

Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE

CVSS 7.5

CVE-2026-2942 CRITICAL

ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess

CVSS 9.8

CVE-2026-4808 HIGH

Gerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload

CVSS 7.2

CVE-2026-3535 CRITICAL

DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter

CVSS 9.8

CVE-2026-33273 HIGH

MATCHA INVOICE <= 2.6.6 - Authenticated Arbitrary File Upload and Remote Code Execution

CVSS 7.2

CVE-2026-35573 CRITICAL

ChurchCRM <6.5.3 Backup Restore - Remote Code Execution

CVSS 9.1

CVE-2026-0740 CRITICAL

Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

CVSS 9.8

CVE-2026-35174 CRITICAL

Chyrp Lite <2026.01 Uploads Path - Remote Code Execution

CVSS 9.1

CVE-2026-35164 HIGH

Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint

CVSS 8.8

CVE-2026-35047 CRITICAL

Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint

CVSS 9.8

CVE-2026-5670 MEDIUM

Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload

CVSS 6.3

CVE-2026-5704 MEDIUM

Tar: tar: hidden file injection via crafted archives

CVSS 5.0

CVE-2026-5576 MEDIUM

SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload

CVSS 4.7

CVE-2026-5573 HIGH

Technostrobe HI-LED-WR120-G2 fs unrestricted upload

CVSS 7.3

CVE-2026-5546 MEDIUM

Campcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted upload

CVSS 6.3

CVE-2026-5472 MEDIUM

ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload

CVSS 6.3

CVE-2026-34735 HIGH

Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`

CVE-2026-2701 CRITICAL

RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)

CVSS 9.1