Weaknesses of type CWE-434

3,108 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-4291MEDIUMIdeaCMS saveUpload unrestricted uploadEPSS 0.4%CVE-2025-57176MEDIUMOn Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP poEPSS 0.4%CVE-2025-9847MEDIUMScriptAndTools Real Estate Management System register.php unrestricted uploadEPSS 0.4%CVE-2025-63748HIGHQaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The applicatEPSS 0.4%CVE-2025-9296MEDIUMEmlog Pro blogger.php unrestricted uploadEPSS 0.4%CVE-2026-65986HIGHCVAT has stored XSS via annotation guide assetsEPSS 0.4%CVE-2025-10465HIGHUnrestricted File Upload in Birtech Information Technologies' SensawayEPSS 0.4%CVE-2026-52705CRITICALWordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2024-42054MEDIUMCervantes through 0.5-alpha accepts insecure file uploads.EPSS 0.4%CVE-2026-54087HIGHEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageFieldEPSS 0.4%CVE-2025-4538MEDIUMkkFileView fileUpload unrestricted uploadEPSS 0.4%CVE-2025-20274MEDIUMCisco Unified Intelligence Center Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2025-53260CRITICALWordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2026-81240HIGHDell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unaEPSS 0.4%CVE-2026-81239HIGHDell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unaEPSS 0.4%CVE-2025-32744MEDIUMDell AppSync, version(s) 4.6.0.0, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker withEPSS 0.4%CVE-2026-1061MEDIUMxiweicheng TMS FileController.java upload unrestricted uploadEPSS 0.4%CVE-2025-7939MEDIUMjerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java addGoods unrestricted uploadEPSS 0.4%CVE-2025-56263HIGHby-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users cEPSS 0.4%CVE-2025-54473CRITICALExtension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for JoomlaEPSS 0.4%