CWE-434 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-434 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2017-12617When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.…100.0%높음8.1● 실제 악용이 확인됨CVE-2018-15961Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and…100.0%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2021-31207Microsoft Exchange Server Security Feature Bypass Vulnerability99.8%보통6.6● 랜섬웨어 캠페인에 사용됨CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the r…99.7%높음8.1● 랜섬웨어 캠페인에 사용됨CVE-2025-31324SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowi…99.5%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2024-50623In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an …98.6%심각9.8● 실제 악용이 확인됨CVE-2016-3088The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to uploa…98.5%심각9.8● 실제 악용이 확인됨CVE-2020-25213The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload…97.3%심각9.8
전체 목록
120건
CVE-2020-8260악용 확인A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker …96.5%높음7.2
CVE-2024-7399악용 확인Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server versio…91.9%심각9.8
CVE-2026-48908악용 확인A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimate…88.5%심각10.0
CVE-2025-52691랜섬웨어 악용Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files…85.7%심각10.0
CVE-2017-11357랜섬웨어 악용Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUploa…77.7%심각9.8
CVE-2019-8394악용 확인Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary f…63.3%보통6.5
CVE-2026-48356악용 확인Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could resu…44.6%심각9.3
CVE-2021-27860악용 확인A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 1…39.7%높음8.8
CVE-2021-26828악용 확인OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to uplo…39.1%높음8.8
CVE-2020-13671악용 확인Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being inte…36.2%높음8.8
CVE-2024-57968악용 확인Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (…32.3%높음8.8
CVE-2026-56290악용 확인Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla…30.9%심각10.0
CVE-2018-4063악용 확인An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless A…27.3%높음8.8
CVE-2026-48939악용 확인A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachme…20.1%심각10.0
CVE-2021-20022랜섬웨어 악용SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker t…16.6%높음7.2
CVE-2026-56291악용 확인Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla e…14.9%심각10.0
CVE-2021-36741악용 확인An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and …5.0%높음8.8
CVE-2025-2749악용 확인An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to …4.0%높음7.2
CVE-2024-39717악용 확인The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is…4.0%높음7.2
CVE-2024-7694악용 확인ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attac…1.8%높음7.2
CVE-2026-12269Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerabilit…7.0%높음8.8
CVE-2026-84434The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and inclu…3.9%심각9.8
CVE-2026-12264Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover …2.0%높음8.8
CVE-2026-45140Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticate…1.3%심각9.8
CVE-2026-82901The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insuffi…1.1%심각9.8
CVE-2026-104800The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including,…1.0%심각9.8
CVE-2026-110002The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to…1.0%심각9.8
CVE-2026-93031The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are v…1.0%높음8.8
CVE-2026-36467Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote au…1.0%높음7.2
CVE-2026-94104NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint th…1.0%높음8.7
CVE-2026-108587The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerabl…0.9%심각9.8
CVE-2026-77929ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achiev…0.9%높음8.7
CVE-2026-105032The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling se…0.9%심각9.1
CVE-2026-93388The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitra…0.9%심각9.8
CVE-2026-76012The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote…0.8%높음7.5
CVE-2026-44402Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload…0.9%심각9.3
CVE-2026-88738Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package…0.9%높음8.8
CVE-2026-76010The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote…0.8%높음8.8
CVE-2026-87855The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions …0.8%심각9.8
CVE-2026-102427Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site…0.8%심각10.0
CVE-2026-118235The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is …0.7%심각9.8
CVE-2026-90866A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on W…0.7%심각9.1
CVE-2026-115188An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing a…0.7%심각9.9
CVE-2026-109384The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all …0.7%높음8.8
CVE-2026-50006Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticat…0.8%심각9.1
CVE-2026-86461The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all vers…0.7%높음8.8
CVE-2026-18351The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload …0.8%심각9.8
CVE-2026-103889The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all…0.7%심각9.8
CVE-2026-102785Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOthem…0.7%심각10.0
CVE-2026-117607Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated …0.7%높음8.6
CVE-2026-109219The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and includin…0.7%심각9.8
CVE-2026-115346The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Up…0.7%높음8.1
CVE-2026-54177backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel pa…0.7%보통6.6
CVE-2026-76552The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of f…0.7%높음8.8
CVE-2026-109218The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and inc…0.6%심각9.8
CVE-2026-94589The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is v…0.7%심각9.8
CVE-2026-83526The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and includi…0.6%높음8.8
CVE-2026-108113ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import i…0.6%높음8.7
CVE-2026-103688The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types …0.6%심각9.8
CVE-2026-88857Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery e…0.6%심각9.4
CVE-2026-8778The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress …0.6%심각9.8
CVE-2026-116512The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for W…0.6%심각9.8
CVE-2026-87796The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versio…0.6%심각9.8
CVE-2026-93352Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extensio…0.6%심각9.3
CVE-2026-78088The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerabl…0.6%높음8.8
CVE-2026-54675FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the…0.6%높음8.7
CVE-2026-103768The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File U…0.6%심각9.8
CVE-2026-61738SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior …0.6%심각10.0
CVE-2023-54405H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthentica…0.6%심각9.3
CVE-2026-92553The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary…0.6%높음8.8
CVE-2026-54567Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in…0.6%높음7.5
CVE-2026-52835Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_con…0.6%높음7.0
CVE-2026-87800IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due …0.5%보통6.8
CVE-2026-100389GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's att…0.6%심각9.2
CVE-2026-75873The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font…0.6%심각9.8
CVE-2026-105899ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result i…0.6%심각10.0
CVE-2026-13249An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interfa…0.6%심각9.8
CVE-2026-102454EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can…0.6%높음8.6
CVE-2026-104028The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification,…0.6%심각9.8
CVE-2026-105701The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and incl…0.5%높음8.8
CVE-2026-94132Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailin…0.6%심각9.5
CVE-2026-87935The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and incl…0.5%높음8.1
CVE-2026-92980HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated ad…0.5%높음8.6
CVE-2026-111255The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to…0.5%높음7.5
CVE-2026-17196The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload…0.5%높음8.8
CVE-2026-82187The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of upl…0.5%심각9.8
CVE-2026-104069HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an upl…0.5%높음8.6
CVE-2026-56660GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.…0.5%심각9.1
CVE-2026-111311The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, …0.5%높음8.8
CVE-2026-104752The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded thro…0.5%높음7.2
CVE-2026-42322Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_sta…0.5%심각9.1
CVE-2026-54611InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Ex…0.5%보통5.5
CVE-2026-92820The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions…0.5%높음8.1
CVE-2026-105123W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticat…0.5%높음8.7
CVE-2026-86239A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAct…0.5%보통5.5
CVE-2026-84999The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions u…0.5%심각9.8
CVE-2026-90864A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on W…0.5%심각9.1
CVE-2026-86666A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_jso…0.5%보통5.5
CVE-2026-94383The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating th…0.5%높음8.6
CVE-2026-81650The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensi…0.5%높음7.2
CVE-2026-90603A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is…0.5%보통6.9
CVE-2026-76174Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpo…0.5%심각9.4
CVE-2026-32579Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.0.5%심각10.0
CVE-2026-115245The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying onl…0.5%심각9.8
CVE-2026-112149A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0…0.5%보통5.5
CVE-2026-39759Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.0.5%심각9.9
CVE-2026-119620A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a0…0.5%보통5.5
CVE-2026-88419An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=…0.5%높음8.8
CVE-2026-103521In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the do…0.5%높음7.2
CVE-2026-26212Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability t…0.5%높음8.6
CVE-2026-82988There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows …0.5%높음7.5
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.