CWE-434

4,227 vulnerabilities with CWE-434

CVE-2025-66480 CRITICAL

wildfirechat im-server < 1.4.3 - Path Traversal and Arbitrary File Write via /fs Upload Endpoint

CVSS 9.8

CVE-2025-57795 CRITICAL

Explorance Blue < 8.14.13 - Authenticated Remote File Download and Remote Code Execution

CVSS 9.9

CVE-2025-57794 CRITICAL

Explorance Blue < 8.14.9 - Authenticated Unrestricted File Upload and Remote Code Execution

CVSS 9.1

CVE-2025-69559 CRITICAL

carmelo computer_book_store 1.0 - Unrestricted Upload of File with Dangerous Type via admin_add.php

CVSS 9.8

CVE-2025-69565 CRITICAL

Mobile Shop Management System 1.0 - Unrestricted File Upload via ExAddProduct.php

CVSS 9.8

CVE-2025-13374 CRITICAL

Kalrav AI Agent <2.3.3 - File Upload

CVSS 9.8

CVE-2025-70457 CRITICAL

Sourcecodester Modern Image Gallery App 1.0 - Unauthenticated Remote Code Execution via File Upload

CVSS 9.8

CVE-2025-69828 CRITICAL

TMS Management Console <6.3.7.27386.20250818 - RCE

CVSS 10.0

CVE-2025-69312 CRITICAL

Xpro Elementor Addons <1.4.19.1 - RCE

CVSS 9.1

CVE-2025-68986 CRITICAL

zozothemes Miion <= 1.2.7 - Unrestricted Upload of File with Dangerous Type

CVSS 9.9

CVE-2025-68910 CRITICAL

blazethemes Blogzee <= 1.0.5 - Code Injection

CVSS 9.9

CVE-2025-68909 CRITICAL

blazethemes Blogistic <1.0.5 - UAFDT

CVSS 9.9

CVE-2025-68001 CRITICAL

garidium g-FFL Checkout <2.1.0 - Unrestricted File Upload

CVSS 10.0

CVE-2025-67968 CRITICAL

InspiryThemes Real Homes CRM <1.0.0 - Unrestricted Upload of File w...

CVSS 9.9

CVE-2025-62056 CRITICAL

blazethemes News Event <1.0.1 - Uplaod of File with Dangerous Type

CVSS 9.9

CVE-2025-62050 CRITICAL

Blogmatic <1.0.4 - Uplaod of File with Dangerous Type

CVSS 9.9

CVE-2025-50002 CRITICAL

Farost Energia energia <1.1.2 - RCE

CVSS 10.0

CVE-2025-10856 HIGH

Teknoera <01102025 - Code Injection

CVSS 8.1

CVE-2025-33015 HIGH

IBM Concert <2.1.0 - Code Injection

CVSS 8.8

CVE-2025-55251 LOW

HCL AION - Unrestricted File Upload

CVSS 3.1

CVE-2025-14632 MEDIUM

Filr - Secure document library <= 1.2.11 - Authenticated Stored Cross-Site Scripting via Unrestricted File Upload

CVSS 4.4

CVE-2025-14894 CRITICAL

livewire-filemanager/filemanager < 1.0.0 - Unauthenticated Remote Code Execution via Unrestricted File Upload

CVSS 9.8

CVE-2025-12957 HIGH

All-in-One Video Gallery <4.5.7 - RCE

CVSS 8.8

CVE-2025-67079 CRITICAL

agora-project < 25.10 - Remote Code Execution via Crafted PDF Upload to Imagick MSL Engine

CVSS 9.8

CVE-2025-67077 HIGH

agora-project < 25.10 - Unrestricted File Upload via UploadTmpFile Action

CVSS 8.8