Weaknesses of type CWE-434

3,108 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-5162MEDIUMH3C SecCenter SMP-E1114P02 importFile unrestricted uploadEPSS 0.4%CVE-2025-62047CRITICALWordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-68562CRITICALWordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-7152MEDIUMCampcodes Advanced Online Voting System candidates_add.php unrestricted uploadEPSS 0.4%CVE-2025-7151MEDIUMCampcodes Advanced Online Voting System voters_add.php unrestricted uploadEPSS 0.4%CVE-2025-47663CRITICALWordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-7124MEDIUMcode-projects Online Note Sharing Profile Image userprofile.php unrestricted uploadEPSS 0.4%CVE-2025-39402CRITICALWordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-7210MEDIUMcode-projects/Fabian Ros Library Management System profile_update.php unrestricted uploadEPSS 0.4%CVE-2026-40262HIGHNote Mark has Stored XSS via Unrestricted Asset UploadEPSS 0.4%CVE-2026-0643MEDIUMprojectworlds House Rental and Property Listing Signup register.php unrestricted uploadEPSS 0.4%CVE-2025-29405MEDIUMAn arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbEPSS 0.4%CVE-2026-61448LOWParse Server 9.0.0 Stored XSS via malformed Content-TypeEPSS 0.4%CVE-2025-12268MEDIUMLearnHouse Course Thumbnail courses unrestricted uploadEPSS 0.4%CVE-2025-0399MEDIUMStarSea99 starsea-mall uploadController.java UploadController unrestricted uploadEPSS 0.4%CVE-2025-8504MEDIUMcode-projects Kitchen Treasure userregistration.php unrestricted uploadEPSS 0.4%CVE-2025-7175MEDIUMcode-projects E-Commerce Site users_photo.php unrestricted uploadEPSS 0.4%CVE-2024-2125HIGHEnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File UploadEPSS 0.4%CVE-2025-58048CRITICALPaymenter Vulnerable to Remote Code Execution via Public File UploadsEPSS 0.4%CVE-2026-25201HIGHAn unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue EPSS 0.4%