Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3381 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-32682 2025-04-17 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG Lite allows Upload a Web Shell to a Web Server. This issue affects MapSVG Lite: from n/a through 8.5.34.
CVE-2025-32652 2025-04-17 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra allows Using Malicious Files. This issue affects Solace Extra: from n/a through 1.3.1.
CVE-2023-51421 1 Soft8soft 1 Verge3d 2025-04-17 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.
CVE-2023-52044 1 Std42 1 Elfinder 2025-04-17 9.8 Critical
Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.
CVE-2022-46135 1 Aerocms Project 1 Aerocms 2025-04-17 7.2 High
In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which we can upload webshell and control the web server.
CVE-2022-46839 1 Wiselyhub 1 Js Help Desk 2025-04-17 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1.
CVE-2023-42248 1 Seling 1 Visual Access Manager 2025-04-17 6.5 Medium
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vam_Sql.php".
CVE-2022-46020 1 Wbce 1 Wbce Cms 2025-04-17 9.8 Critical
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
CVE-2024-46377 2 Mayurik, Sourcecodester 2 Best House Rental Management System, Best House Rental Management System 2025-04-16 9.8 Critical
Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php.
CVE-2024-33438 1 Cubecart 1 Cubecart 2025-04-16 8 High
File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.
CVE-2024-31615 1 Thinkcmf 1 Thinkcmf 2025-04-16 9.8 Critical
ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.
CVE-2021-27428 1 Ge 38 Multilin B30, Multilin B30 Firmware, Multilin B90 and 35 more 2025-04-16 9.8 Critical
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.
CVE-2021-32961 1 Auvesy-mdt 2 Autosave, Autosave For System Platform 2025-04-16 7.5 High
A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.
CVE-2021-43934 1 Smartptt 1 Smartptt Scada 2025-04-16 9.8 Critical
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
CVE-2021-33009 1 Myscada 1 Mypro 2025-04-16 7.5 High
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.
CVE-2022-1519 1 Illumina 8 Iseq 100, Local Run Manager, Miniseq and 5 more 2025-04-16 10 Critical
LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.
CVE-2022-2102 1 Secheron 2 Sepcos Control And Protection Relay, Sepcos Control And Protection Relay Firmware 2025-04-16 9.4 Critical
Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.
CVE-2022-0517 1 Mozilla 1 Vpn 2025-04-16 7.8 High
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN < 2.7.1.
CVE-2021-38397 1 Honeywell 8 Application Control Environment, Application Control Environment Firmware, C200 and 5 more 2025-04-16 10 Critical
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
CVE-2022-2791 1 Emerson 1 Proficy 2025-04-16 5.9 Medium
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.