CWE-434 · weakness in File and Path Handling
Unrestricted File Upload
4,345 CVEs · 26 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 26
- check available
- 115
- likely to be exploited
- 257
Every one of the 4,345 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Tomcat - Remote Code Execution
- Adobe ColdFusion - Unrestricted File Upload Remote Code Execution
- Microsoft Exchange Server Security Feature Bypass Vulnerability
- Apache Tomcat Servers - Remote Code Execution
- SAP NetWeaver Visual Composer Metadata Uploader - Deserialization
SAP1 article1 article this week: SANS observes attackers targeting SAP NetWeaver webshells
- Cleo Harmony < 5.8.0.21 - Arbitary File Read
- Apache ActiveMQ Fileserver - Arbitrary File Write
- WordPress File Manager Plugin - Remote Code Execution
- A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extrac…
- Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCE
- SmarterMail - Unrestricted File Upload
- Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or…
- Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
- Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
- Arbitrary file upload vulnerability in FatPipe software
- OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
- Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). u…
- Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type…
- Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload
- An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a…
- Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE
- SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload
- An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upl…
- The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or…
- TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.