Advisories · Weakness
CWE-351.
Every Advisory and CVE whose sources give the weakness CWE-351, newest first.
- CVSS 6.3 Medium
TYPO3 CMS - Unrestricted File Upload in Form Framework
- CWE-351
>=14.2.0, <14.3.5 · fixed in 14.3.5
GHSA-mfqj-cqv3-h7xw · CVE-2026-15305 - CVSS 4.0, no score published
Duplicate Advisory: TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework
- CWE-351
>=14.2.0, <14.3.5 · fixed in 14.3.5
GHSA-p8pr-442q-qf8g - CVSS 8.8 High
HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability
- HCL BigFix RunBookAI
- Command injection
- CWE-351
- CVSS 5.4 Medium
Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message
- CWE-351
<2026.3.31 · fixed in 2026.3.31
GHSA-pr66-whqj-rq5p - CVSS 2.3 Low
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message
- Broken access control
- CWE-351
<2026.3.31 · fixed in 2026.3.31
GHSA-6336-qqw9-v6x6 · CVE-2026-41341 - CVSS 6.6 Medium
Contao is vulnerable to remote code execution in template closures
- CWE-351
>=4.0.0, <4.13.57 || >=5.0.0-RC1, <5.3.42 || >=5.4.0-RC1, <5.6.5 · fixed in 4.13.57, 5.3.42, 5.6.5
GHSA-98vj-mm79-v77r · CVE-2025-65960 - CVSS 8.7 High
Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time
- CWE-351
<0.12.0 · fixed in 0.12.0
GHSA-4v6w-xpmh-gfgp · CVE-2025-54413 - CVSS 8.7 High
Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution
- CWE-351
<0.12.0 · fixed in 0.12.0
GHSA-m7f4-hrc6-fwg3 · CVE-2025-54412 - CVSS 5.4 Medium
TYPO3 Allows Unrestricted File Upload in File Abstraction Layer
- Unrestricted file upload
- CWE-351
>=9.0.0, <9.5.51 || >=10.0.0, <10.4.50 || >=11.0.0, <11.5.44 || >=12.0.0, <12.4.31 || >=13.0.0, <13.4.12 · fixed in 9.5.51, 10.4.50, 11.5.44, 12.4.31, 13.4.12
GHSA-9hq9-cr36-4wpj · CVE-2025-47939 - CVSS 9.3 CriticalCritical · CVSS 9+
Growatt Cloud portal Insufficient Type Distinction
- Growatt Cloud portal
- CWE-351
- CVSS 2.6 Low
DNN does not check the contents of a file when uploading files
- dnnsoftware Dnn.Platform
- CWE-351
- CVSS 3.7 Low
Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution
- Memory corruption
- CWE-351
>=0.182.0, <0.257.0 · fixed in 0.257.0
GHSA-5xh2-23cc-5jc6 · CVE-2025-22151 - CVSS 4.3 Medium
IBM Cognos Controller file upload
- IBM Cognos Controller
- CWE-351
- CVSS 5.9 Medium
Mozilla Firefox: When importing resources using Web Workers…
- Mozilla Firefox
- Mozilla Firefox ESR
- CWE-351
- CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.
- CWE-351
- CVSS 7.3 High
Advantech WebAccess Insufficient Type Distinction
- Advantech WebAccess/SCADA
- CWE-351
-
Incorrect type conversion in Swift Project Swift Corelib-Foundation
- Swift Project Swift Corelib-Foundation
- CWE-241
- CWE-351
- CVSS 6.3 Medium
Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks
- Bluetooth LE
- CWE-351