Vulnerabilities (CVE)

Filtered by CWE-434
Total 2645 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-46482 2024-10-23 N/A 8.2 HIGH
An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .html or .svg file.
CVE-2024-49611 1 Paxman 1 Product Website Showcase 2024-10-23 N/A 9.8 CRITICAL
Unrestricted Upload of File with Dangerous Type vulnerability in Paxman Product Website Showcase allows Upload a Web Shell to a Web Server.This issue affects Product Website Showcase: from n/a through 1.0.
CVE-2024-10161 1 Phpgurukul 1 Boat Booking System 2024-10-21 6.5 MEDIUM 8.8 HIGH
A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file change-image.php of the component Update Boat Image Page. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-45136 3 Adobe, Apple, Microsoft 3 Incopy, Macos, Windows 2024-10-18 N/A 7.8 HIGH
InCopy versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerability by uploading a malicious file which can then be executed on the server. Exploitation of this issue requires user interaction.
CVE-2024-45137 3 Adobe, Apple, Microsoft 3 Indesign, Macos, Windows 2024-10-18 N/A 7.8 HIGH
InDesign Desktop versions 19.4, 18.5.3 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by uploading a malicious file which, when executed, could run arbitrary code in the context of the server. Exploitation of this issue requires user interaction.
CVE-2024-47423 2 Adobe, Microsoft 2 Framemaker, Windows 2024-10-18 N/A 7.8 HIGH
Adobe Framemaker versions 2020.6, 2022.4 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by uploading a malicious file which can be automatically processed or executed by the system. Exploitation of this issue requires user interaction.
CVE-2024-48180 2024-10-18 N/A 9.8 CRITICAL
ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code.
CVE-2024-49291 2024-10-18 N/A 10.0 CRITICAL
Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0.
CVE-2024-49398 2024-10-18 N/A N/A
The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code.
CVE-2024-8918 1 Filemanagerpro 1 File Manager 2024-10-17 N/A 5.4 MEDIUM
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
CVE-2024-8746 1 Filemanagerpro 1 File Manager 2024-10-17 N/A 8.8 HIGH
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
CVE-2024-9981 1 Formosasoft 1 Ee-class 2024-10-17 N/A 8.8 HIGH
The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server.
CVE-2024-9816 1 Codezips 1 Tourist Management System 2024-10-17 5.8 MEDIUM 7.2 HIGH
A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9815 1 Codezips 1 Tourist Management System 2024-10-17 5.8 MEDIUM 7.2 HIGH
A vulnerability has been found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/create-package.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9985 1 Ragic 1 Enterprise Cloud Database 2024-10-16 N/A 9.8 CRITICAL
Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server.
CVE-2024-48782 2024-10-16 N/A 9.8 CRITICAL
File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application only detecting the extension of image files in the front-end.
CVE-2024-48781 2024-10-16 N/A 9.8 CRITICAL
An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a specially constructed so file/opt/EdrawProj-2/plugins/imageformat.
CVE-2024-49242 2024-10-16 N/A 10.0 CRITICAL
Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through 3.0.5.
CVE-2024-47649 2024-10-16 N/A 9.1 CRITICAL
Unrestricted Upload of File with Dangerous Type vulnerability in THATplugin Iconize.This issue affects Iconize: from n/a through 1.2.4.
CVE-2024-49260 2024-10-16 N/A 9.9 CRITICAL
Unrestricted Upload of File with Dangerous Type vulnerability in Limb WordPress Gallery Plugin – Limb Image Gallery allows Code Injection.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through 1.5.7.