Cwe-434 - Unrestricted Upload Of File With Dangerous Type - Cwe

Related Threat Clusters

• Critical Joomla JCE Vulnerability Under Active Exploitation

  A critical vulnerability in the Joomla Content Editor (JCE), tracked as CVE-2026-48907, allows unauthenticated attackers to execute remote code on affected Joomla sites. This flaw affects JCE versions below 2.9.99.6 and…

  33 articles · Updated June 17, 2026
• Critical RCE Vulnerability in Blocksy Companion Pro Plugin Discovered

  A critical vulnerability, CVE-2026-58480, has been identified in the Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47. This unauthenticated arbitrary file upload vulnerability allows attackers to…

  2 articles · Updated July 9, 2026
• New Vulnerabilities Discovered in Serial-to-IP Converters Threaten Critical Infrastructure

  Forescout Technologies has identified 22 new vulnerabilities in serial-to-IP converters from Lantronix and Silex, which are widely used in critical sectors like healthcare and utilities. These vulnerabilities,…

  9 articles · Updated April 21, 2026
• CISA Alerts on Critical Flaws in SimpleHelp, Samsung MagicINFO, and D-Link Devices

  On April 24, 2026, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The affected products include SimpleHelp remote management software, Samsung MagicINFO 9 Server, and…

  3 articles · Updated April 26, 2026
• Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress

  The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload, allowing Remote Code Execution in all versions up to 5.1.8. This vulnerability arises from insufficient file extension validation in the…

  9 articles · Updated July 3, 2026
• Critical Remote Code Execution Vulnerability in GitBucket Disclosed

  A critical vulnerability (CVE-2018-25332) has been identified in GitBucket version 4.23.1, allowing unauthenticated remote code execution. Attackers can exploit weak secret token generation and insecure file upload…

  2 articles · Updated May 17, 2026
• Critical RCE Vulnerability in Vvveb CMS v1.0.8 Discovered

  A remote code execution vulnerability, identified as CVE-2026-6257, has been discovered in Vvveb CMS version 1.0.8. The flaw resides in the media management functionality, where a missing return statement in the file…

  4 articles · Updated April 21, 2026
• Critical Unauthenticated File Upload Vulnerability in RSFiles! Fixed

  A severe unauthenticated file upload vulnerability was discovered in RSFiles! up to version 1.17.11, allowing attackers to upload malicious files, including .php scripts, to the public downloads directory. This flaw…

  2 articles · Updated July 10, 2026
• CISA Warns of Active Exploitation of Cisco Catalyst SD-WAN Vulnerabilities

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of three vulnerabilities in Cisco's Catalyst SD-WAN Manager, specifically CVE-2026-20122,…

  16 articles · Updated April 21, 2026
• Critical RCE Vulnerability in WordPress Plugin CVE-2026-6518

  The CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress has a critical vulnerability (CVE-2026-6518) affecting all versions up to 4.1.16. This vulnerability allows authenticated users with Administrator…

  2 articles · Updated April 19, 2026

Recent Intelligence Reports

• 434 — cwe.mitre.org · July 11, 2026
• Wordpress Blocksy Companion Plugin 2 1 46 Unauthenticated Arbitrary File Upload Vulnerability — patchstack.com · July 9, 2026
• CVE-2026-58480 — nvd.nist.gov · July 9, 2026
• CVE-2026-58480: Blocksy Companion Pro plugin Remote code execution — Sherlockforensics · July 9, 2026
• JVN#40604023 prior disclosure — jvn.jp · July 5, 2026
• CVE-2026-5524 INCIBE-CERT - Vulnerabilities RSS / 22h The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. — www.incibe.es · July 3, 2026
• CVE-2026-5524 - Exploits & Severity — Feedly · July 2, 2026
• Cisco Unified CM Flaw Faces Active Exploitation After PoC Release — Mallory.Ai · June 24, 2026

Related Entities