#cwe-434

共收录 549 条相关情报。

← 返回所有主题

漏洞预警2026-06-26 发布HIGH

A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locat...

CVE-2026-56414

H.View IP摄像机的证书相关上传接口存在设计缺陷：已认证用户可将任意文件内容（不验证文件类型、结构或大小）存储到固定的、持久化的文件系统位置。这些位置原本用于存放受信任的证书材料，因此恶意或格式错误的数据可能被写入关键路径，导致系统完

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-26 发布HIGH

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type wit...

CVE-2026-33560

CVE-2026-33560 影响 DMP-5000 文件服务，该服务暴露了经过身份验证的任意文件上传端点。攻击者可以利用这些端点上传任意类型文件，系统未对文件扩展名或内容进行任何检查或过滤，导致可执行二进制文件或脚本被直接写入服务器。此漏

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-26 发布INFO

Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

CVE-2026-57658

Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-26 发布INFO

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

CVE-2026-56059

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-26 发布INFO

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

CVE-2026-56058

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-26 发布INFO

Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.

CVE-2026-56027

Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-25 发布INFO

Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.

CVE-2026-57700

Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This i

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-25 发布INFO

The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under the K2 web user. A...

CVE-2026-48946

The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php ma

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-25 发布INFO

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names —...

CVE-2026-48945

The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries//`, and only rename

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-24 发布INFO

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint all...

CVE-2026-53948

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied C

历史摘要 · 未重新核验 · NVD

安全公告2026-06-22 发布INFO

Paymenter vulnerable to Remote Code Execution via public file uploads

CVE-2025-58048

### Impact The ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-434 #severity:critical

漏洞预警2026-06-19 发布INFO

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files ...

CVE-2019-25758

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-19 发布INFO

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administr...

CVE-2026-54414

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedF

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-434

漏洞预警2026-06-18 发布INFO

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' p...

CVE-2026-9860

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all ver

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-16 发布INFO

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Stor...

CVE-2026-40750

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Sh

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-16 发布INFO

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePl...

CVE-2026-6933

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in version

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-15 发布INFO

Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.

CVE-2026-40772

Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-15 发布INFO

Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

CVE-2026-39591

Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-15 发布INFO

Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.

CVE-2026-39527

Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-06-15 发布INFO

An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file.

CVE-2026-50873

An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to exec

历史摘要 · 未重新核验 · NVD