CWE-434

4,227 vulnerabilities with CWE-434

CVE-2025-66074 CRITICAL

Cozmoslabs WP Webhooks <3.3.8 - Path Traversal

CVSS 9.0

CVE-2025-64374 CRITICAL

StylemixThemes Motors <5.6.81 - Unrestricted Upload

CVSS 9.9

CVE-2025-64231 CRITICAL

RedefiningTheWeb WordPress Contact Form 7 PDF - Unrestricted Upload...

CVSS 9.9

CVE-2025-68109 CRITICAL

ChurchCRM < 6.5.3 - Remote Code Execution via Database Restore File Upload

CVSS 9.1

CVE-2025-67164 CRITICAL

Pagekit 1.0.18 - Authenticated Arbitrary File Upload and Remote Code Execution via /storage/poc.php

CVSS 9.9

CVE-2025-66449 HIGH

ConvertX < 0.16.0 - Authenticated Arbitrary File Write via Upload Endpoint

CVSS 8.8

CVE-2025-14642 MEDIUM

Computer Laboratory System 1.0 - Unrestricted Upload

CVSS 4.7

CVE-2025-14641 MEDIUM

Computer Laboratory System 1.0 - Unrestricted Upload

CVSS 4.7

CVE-2025-13094 HIGH

WP3D Model Import Viewer <1.0.8 - RCE

CVSS 8.8

CVE-2025-14583 HIGH

campcodes Online Student Enrollment System 1.0 - Unrestricted Upload

CVSS 7.3

CVE-2025-14582 MEDIUM

campcodes Online Student Enrollment System 1.0 - Unrestricted Upload

CVSS 4.7

CVE-2025-12968 HIGH

Infility Global <2.14.23 - File Upload

CVSS 8.8

CVE-2025-34506 HIGH

WBCE CMS < 1.6.3 - Authenticated Remote Code Execution via Malicious Module Upload

CVSS 8.8

CVE-2025-14530 MEDIUM

Real Estate Property Listing App 1.0 - Unrestricted File Upload via Image Argument in /admin/property.php

CVSS 4.7

CVE-2025-65474 CRITICAL

EasyImages 2.0 <= 2.8.6 manager.php - PHP File Rename Code Execution

CVSS 9.8

CVE-2025-65471 HIGH

easyimages2.0 < 2.8.6 - Arbitrary File Upload via /admin/manager.php

CVSS 8.8

CVE-2025-14522 MEDIUM

baowzh hfly < 2016-05-11 - Unrestricted File Upload via imgFile Parameter

CVSS 6.3

CVE-2025-14390 HIGH

Video Merchant <= 5.0.4 - Unauthenticated Arbitrary File Upload via CSRF in video_merchant_add_video_file

CVSS 8.8

CVE-2025-67506 CRITICAL

PipesHub <0.1.0-beta - Path Traversal

CVSS 9.8

CVE-2025-61808 CRITICAL

ColdFusion <= 2025.4, <= 2023.16, <= 2021.22 - Authenticated Arbitrary File Upload

CVSS 9.1

CVE-2025-56704 HIGH

LeptonCMS 7.3.0 - Authenticated Arbitrary File Upload via ZIP/PHP File

CVSS 8.8

CVE-2025-14219 MEDIUM

Campcodes Retro Basketball Shoes Online Store 1.0 - Unrestricted File Upload via product_image Argument

CVSS 4.7

CVE-2025-14199 MEDIUM

Verysync <2.21.3 - Unrestricted Upload

CVSS 6.3

CVE-2025-14195 MEDIUM

Employee Profile Management System 1.0 - Unrestricted File Upload via per_file Argument

CVSS 6.3

CVE-2025-13065 HIGH

Starter Templates <= 4.4.41 - Authenticated Arbitrary File Upload via Double Extension Bypass

CVSS 8.8