Weaknesses of type CWE-434

3,112 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-12862MEDIUMprojectworlds Online Notes Sharing Platform userprofile.php unrestricted uploadEPSS 0.4%CVE-2024-34021MEDIUMUnrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploadeEPSS 0.4%CVE-2024-13355MEDIUMAdmin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site ScriptingEPSS 0.4%CVE-2025-64374CRITICALWordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2024-13133MEDIUMZeroWdd studentmanager StudentController. java editStudent unrestricted uploadEPSS 0.4%CVE-2025-36174HIGHIBM Integrated Analytics System file uploadEPSS 0.4%CVE-2025-7190MEDIUMcode-projects Library Management System student_edit_photo.php unrestricted uploadEPSS 0.4%CVE-2025-14842MEDIUMDrag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File UploadEPSS 0.4%CVE-2025-7412MEDIUMcode-projects Library System profile.php unrestricted uploadEPSS 0.4%CVE-2025-7413MEDIUMcode-projects Library System profile.php unrestricted uploadEPSS 0.4%CVE-2026-0577MEDIUMcode-projects Online Product Reservation System prod.php unrestricted uploadEPSS 0.4%CVE-2025-14199MEDIUMVerysync 微力同步 Web Administration text.txt unrestricted uploadEPSS 0.4%CVE-2026-0547MEDIUMPHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted uploadEPSS 0.4%CVE-2022-43192MEDIUMAn arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrEPSS 0.4%CVE-2026-1065HIGHForm Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG fileEPSS 0.4%CVE-2025-10371MEDIUMeCharge Hardy Barth Salia PLCC api.php unrestricted uploadEPSS 0.4%CVE-2025-10856HIGHArbitrary File Upload in Solvera Software's TeknoeraEPSS 0.4%CVE-2024-11404MEDIUMFile Upload Bypass in django FilerEPSS 0.4%CVE-2023-42248MEDIUMAn issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipEPSS 0.4%CVE-2026-24729CRITICALInterinfo DreamMaker - Unrestricted Upload of File with Dangerous TypeEPSS 0.4%