Weaknesses of type CWE-434

3,101 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2024-10420MEDIUMSourceCodester Attendance and Payroll System update.php upload unrestricted uploadEPSS 0.5%CVE-2026-57658CRITICALWordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-32524CRITICALWordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-13158HIGHEverest Toolkit <= 1.2.3 - Admin+ Arbitrary File UploadEPSS 0.5%CVE-2026-78274CRITICALWordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-65455CRITICALWordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-46490CRITICALWordPress Crossword Compiler Puzzles plugin <= 5.2 - Arbitrary File Upload VulnerabilityEPSS 0.5%CVE-2026-18933HIGHwp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path TraversalEPSS 0.5%CVE-2026-9421MEDIUMKLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted uploadEPSS 0.5%CVE-2025-30996CRITICALArbitrary File Upload Vulnerability in WordPress themes by ThemifyEPSS 0.5%CVE-2024-10292MEDIUMZZCMS ChangeTable.php unrestricted uploadEPSS 0.5%CVE-2026-86305MEDIUMlight0011 cms Upload.class.php upload unrestricted uploadEPSS 0.5%CVE-2026-7733MEDIUMfunadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted uploadEPSS 0.5%CVE-2026-13553MEDIUMitsourcecode Online Hotel Management System controller.php add unrestricted uploadEPSS 0.5%CVE-2026-2979MEDIUMFastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted uploadEPSS 0.5%CVE-2026-78245MEDIUMitsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted uploadEPSS 0.5%CVE-2026-85208MEDIUMitsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted uploadEPSS 0.5%CVE-2026-82607MEDIUMCozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted uploadEPSS 0.5%CVE-2026-15677MEDIUMcode-projects Online Job Portal JobSeekerInsert.php unrestricted uploadEPSS 0.5%CVE-2026-78202MEDIUMitsourcecode Payroll System admin_class.php save_settings unrestricted uploadEPSS 0.5%