Weaknesses of type CWE-434

3,097 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2026-34031MEDIUMApache Answer: The custom avatar was not properly validatedEPSS 0.6%CVE-2024-1261MEDIUMJuanpao JPShop API ComboController.php actionIndex unrestricted uploadEPSS 0.6%CVE-2026-39931HIGHOpenEMR Authenticated SQL Injection via backup.php Import FeatureEPSS 0.6%CVE-2023-7150MEDIUMCampcodes Chic Beauty Salon Product product-list.php unrestricted uploadEPSS 0.6%CVE-2025-68001CRITICALWordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-6958MEDIUMitsourcecode University Management System Avatar File st_update.php unrestricted uploadEPSS 0.6%CVE-2022-0950MEDIUMUnrestricted Upload of File with Dangerous Type in star7th/showdocEPSS 0.6%CVE-2024-1113MEDIUMopenBI Unity.php uploadUnity unrestricted uploadEPSS 0.6%CVE-2022-47186HIGHUnrestricted Upload of File vulnerability in Generex CS141EPSS 0.6%CVE-2023-5637HIGHPlaintext Storage of a Password in ArslanSoft's Education PortalEPSS 0.6%CVE-2024-7189MEDIUMitsourcecode Online Food Ordering System editproduct.php unrestricted uploadEPSS 0.6%CVE-2026-64960HIGHRemote Code Execution via Unrestricted File Upload in ATutorEPSS 0.6%CVE-2026-57311MEDIUMUnrestricted Upload of File with Dangerous Type in Windu CMSEPSS 0.6%CVE-2021-24620—Simple eCommerce <= 2.2.5 - Arbitrary File UploadEPSS 0.6%CVE-2025-56218CRITICALAn arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.EPSS 0.6%CVE-2026-82793HIGHUnrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a speciaEPSS 0.6%CVE-2025-54449CRITICALUnrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affEPSS 0.6%CVE-2024-31115CRITICALWordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2023-52221CRITICALWordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.1 is vulnerable to Arbitrary File UploadEPSS 0.6%CVE-2025-3040MEDIUMProject Worlds Online Time Table Generator add_student.php unrestricted uploadEPSS 0.6%