CWE-434

4,119 vulnerabilities with CWE-434

CVE-2024-58281 HIGH

Dotclear 2.29 - Authenticated Remote Code Execution via Media Upload

CVSS 8.8

CVE-2024-58279 HIGH

appRain CMF 4.0.5 - Authenticated Remote Code Execution via Filemanager Upload

CVSS 8.8

CVE-2024-13342 HIGH

Booster for WooCommerce <7.2.4 - RCE

CVSS 8.1

CVE-2024-13986 HIGH

Nagios XI < 2024R1.3.2 - Authenticated Remote Code Execution via MIB Upload and Snapshot Rename

CVSS 8.8

CVE-2024-9648 MEDIUM

WP ULike Pro < 1.9.3 - Unauthenticated Arbitrary File Upload via Insufficient File Type Validation

CVSS 6.1

CVE-2024-13981 CRITICAL

LiveBOS < pre-August 2024 builds - Unauthenticated Arbitrary File Upload and Path Traversal via UploadFile.do Endpoint

CVE-2024-39752 MEDIUM

IBM Analytics Content Hub 2.0-2.3 - Unrestricted Upload of Executable Files via Explore Content

CVSS 6.8

CVE-2024-7074 MEDIUM

WSO2 Enterprise Integrator and API Manager - Authenticated Arbitrary File Upload via SOAP Admin Services

CVSS 6.8

CVE-2024-9544 MEDIUM

MapSVG <= 8.6.4 - Authenticated Stored Cross-Site Scripting via SVG File Upload

CVSS 6.4

CVE-2024-11617 CRITICAL

Envolve Plugin < 1.0 - Unauthenticated Arbitrary File Upload via zetra_languageUpload and zetra_fontsUpload Functions

CVSS 9.8

CVE-2024-51991 MEDIUM

October CMS < 3.7.5 - Authenticated SVG Upload Bypass via Extension Renaming

CVSS 4.9

CVE-2024-13418 HIGH

G5Theme April Framework < 5.1 - Authenticated Arbitrary File Upload via ajaxUploadFonts()

CVSS 8.8

CVE-2024-11390 MEDIUM

Kibana 7.17.6-7.17.24 - Authenticated Unrestricted Upload of File with Dangerous Type

CVSS 5.4

CVE-2024-40071 CRITICAL

Sourcecodester Online ID Generator System 1.0 - RCE

CVSS 9.8

CVE-2024-13708 HIGH

Booster for WooCommerce 4.0.1-7.2.4 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

CVSS 7.2

CVE-2024-13744 HIGH

Booster for WooCommerce 4.0.1-7.2.4 - Unauthenticated Arbitrary File Upload

CVSS 8.1

CVE-2024-56975 CRITICAL

InvoicePlane < 1.6.2 - Remote Code Execution via Upload Controller

CVSS 9.8

CVE-2024-9920 HIGH

lollms_web_ui v12 - Remote Code Execution via Unrestricted File Upload and subprocess.Popen

CVSS 8.8

CVE-2024-8958 CRITICAL

composio 0.4.3 - Unrestricted File Upload and Arbitrary File Read via Filetools Actions

CVSS 9.8

CVE-2024-8019 CRITICAL

Lightning-ai/pytorch-lightning <2.3.2 - RCE

CVSS 9.1

CVE-2024-10901 CRITICAL

db-gpt v0.6.0 - Arbitrary File Write and Remote Code Execution via Chart Editor API

CVSS 9.8

CVE-2024-45644 MEDIUM

IBM Security ReaQta 3.12 - Authenticated Unrestricted Upload of Dangerous File Types

CVSS 4.7

CVE-2024-57169 CRITICAL

SOPlanning 1.53.00 - Unrestricted File Upload via /process/upload.php

CVSS 9.8

CVE-2024-54525 HIGH

Apple iPadOS < 18.2 - Unrestricted Upload of File with Dangerous Type via Malicious Backup Restore

CVSS 8.8

CVE-2024-13359 HIGH

WordPress Product Input Fields for WooCommerce <= 1.12.0 - File Upload Code Execution

CVSS 8.1