Weaknesses of type CWE-434

3,112 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-10763MEDIUMacademico-sis academico Profile Picture edit-photo unrestricted uploadEPSS 0.3%CVE-2025-4006MEDIUMyouyiio BeyongCms Document Management Page Upload.html unrestricted uploadEPSS 0.3%CVE-2025-59524HIGHHorilla Stored XSS Vulnerability via File Upload in Reimbursement PanelEPSS 0.3%CVE-2025-15009MEDIUMliweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted uploadEPSS 0.3%CVE-2025-30173MEDIUMAdmin Authorized File UploadEPSS 0.3%CVE-2025-30169MEDIUMAdmin Authorized File Upload and Execute PHPEPSS 0.3%CVE-2025-13573MEDIUMprojectworlds can pass malicious payloads add_book.php unrestricted uploadEPSS 0.3%CVE-2025-14885MEDIUMSourceCodester Client Database Management System Leads Generation user_leads.php unrestricted uploadEPSS 0.3%CVE-2026-5181MEDIUMSourceCodester Simple Doctors Appointment System ajax.php unrestricted uploadEPSS 0.3%CVE-2024-53564LOWA vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-prEPSS 0.3%CVE-2026-9445MEDIUMSourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted uploadEPSS 0.3%CVE-2026-7043MEDIUMGreenCMS index.php pluginAddLocal unrestricted uploadEPSS 0.3%CVE-2026-95820MEDIUManirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted uploadEPSS 0.3%CVE-2026-7044MEDIUMGreenCMS index.php themeadd unrestricted uploadEPSS 0.3%CVE-2026-16451MEDIUMzsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted uploadEPSS 0.3%CVE-2026-5472MEDIUMProjectsAndPrograms School Management System Profile Picture settings.php unrestricted uploadEPSS 0.3%CVE-2026-7107MEDIUMcode-projects Invoice System in Laravel company unrestricted uploadEPSS 0.3%CVE-2026-6489MEDIUMQueryMine sms Background Management addteacher.php unrestricted uploadEPSS 0.3%CVE-2026-4505MEDIUMeosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted uploadEPSS 0.3%CVE-2026-5546MEDIUMCampcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted uploadEPSS 0.3%