CWE-434

4,227 vulnerabilities with CWE-434

CVE-2025-13573 MEDIUM

projectworlds advanced_library_management_system 1.0 - Unrestricted File Upload via /add_book.php Image Parameter

CVSS 6.3

CVE-2025-13544 MEDIUM

ashraf-kabir travel-agency < 2025-07-05 - Unrestricted File Upload via /customer_register.php

CVSS 6.3

CVE-2025-12973 HIGH

S2B AI Assistant for WordPress - Arbitrary File Upload

CVSS 7.2

CVE-2025-13156 HIGH

Vitepos - Point of Sale (POS) for WooCommerce plugin <= 3.3.0 - Arbitrary File Upload

CVSS 8.8

CVE-2025-12138 HIGH

URL Image Importer plugin <1.0.6 - File Upload

CVSS 8.8

CVE-2025-11456 CRITICAL

Elula Wsdesk < 3.3.2 - Unrestricted File Upload

CVSS 9.8

CVE-2025-0645 HIGH

Pyxis Signage <31012025 - Unrestricted Upload of File with Dangerou...

CVSS 7.2

CVE-2025-13423 MEDIUM

Campcodes Retro Basketball Shoes Online Store 1.0 - Unrestricted File Upload via product_image Argument

CVSS 4.7

CVE-2025-13411 MEDIUM

Campcodes Retro Basketball Shoes Online Store 1.0 - Unrestricted File Upload via product_image Argument

CVSS 4.7

CVE-2025-64759 HIGH

homarr < 1.43.3 - Stored Cross-Site Scripting via Malicious SVG File Upload

CVSS 8.1

CVE-2025-34336 MEDIUM

egovframe-common-components <4.3.1 - Unauthenticated File Upload

CVE-2025-34330 MEDIUM

AudioCodes Fax Server and Auto-Attendant IVR <= 2.6.23 - Unauthenticated File Upload

CVSS 5.3

CVE-2025-34329 CRITICAL

AudioCodes Fax Server and Auto-Attendant IVR <= 2.6.23 - Unauthenticated Remote Code Execution via Backup Upload

CVSS 9.8

CVE-2025-34328 CRITICAL

AudioCodes Fax Server and Auto-Attendant IVR <= 2.6.23 - Unauthenticated Arbitrary File Write via ajaxScript.php

CVSS 9.8

CVE-2025-12057 CRITICAL

WavePlayer WP <3.8.0 - Unauthenticated RCE

CVSS 9.8

CVE-2025-63228 CRITICAL

DB Broadcast Mozart FM Transmitter WEBMOZZI-00287 - Unauthenticated File Upload Code Execution

CVSS 9.8

CVE-2025-63227 HIGH

DB Broadcast Mozart FM Transmitter WEBMOZZI-00287 - Authenticated Patch File Upload Code Execution

CVSS 7.2

CVE-2025-63994 CRITICAL

RichFilemanager 2.7.6 - Arbitrary File Upload via UploadHandler.php

CVSS 9.8

CVE-2025-63695 CRITICAL

dzzoffice < 2.3.7 - Arbitrary File Upload via UEditor Controller

CVSS 9.8

CVE-2025-41735 HIGH

metz-connect ewio2-m_firmware < 2.2.0 - Unrestricted File Upload and Remote Code Execution

CVSS 8.8

CVE-2025-41347 CRITICAL

WinPlus v24.11.27 - Unrestricted Upload of Dangerous File Type via /WinplusPortal/ws/sWinplus.svc/json/uploadfile

CVSS 9.8

CVE-2025-13069 HIGH

Enable SVG WebP & ICO Upload <1.1.2 - File Upload

CVSS 8.8

CVE-2025-12775 HIGH

WP Dropzone <1.1.0 - Authenticated File Upload

CVSS 8.8

CVE-2025-12528 HIGH

WordPress Pie Forms <= 1.6 - Unauthenticated File Upload Code Execution

CVSS 8.1

CVE-2025-12974 HIGH

Gravity Forms WordPress <2.9.21.1 - RCE

CVSS 8.1