Advisories · Weakness
CWE-646.
Every Advisory and CVE whose sources give the weakness CWE-646, newest first.
- CVSS 8.7 High
Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
- Cross-site scripting (XSS)
- Unrestricted file upload
<0.9.3 · fixed in 0.9.3
GHSA-m8f9-9whg-f4xr · CVE-2026-45315 - CVSS 4.3 Medium
Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability
- Cisco Enterprise Chat and Email
- CWE-646
- CVSS 6.6 Medium
Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following
- Zoom Communications Inc. Zoom Workplace VDI Plugin macOS Universal installer
- CWE-646
- CVSS 4.3 Medium
Sauter: Arbitrary File Upload
- Sauter modulo 6 devices modu680-AS
- Sauter modulo 6 devices modu660-AS
- CWE-646
- CVSS 8.7 High
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload
- CWE-646
<25.9.0 · fixed in 25.9.0
GHSA-vgmm-27fc-vmgp · CVE-2025-58449 - CVSS 4.0, no score published
Duplicate Advisory: Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis
- CWE-646
- CWE-807
<=0.0.21 · no fixed version yet
GHSA-hw34-rqc5-h2gm - CVSS 5.3 Medium
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious p...
- CWE-184
- CWE-646
<0.0.22 · fixed in 0.0.22
GHSA-655q-fx9r-782v · CVE-2025-1716 - CVSS 9.4 CriticalCritical · CVSS 9+
Stream Target Remote Code Execution in Wowza Streaming Engine
- Wowza Streaming Engine
- CWE-646
- CVSS 5.5 Medium
Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File
- Matrix Tafnit v8
- CWE-646
- CVSS 5.5 Medium
AiLux imx6 bundle: A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability…
- AiLux imx6 bundle
- CWE-646
- CVSS 7.5 High
WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload
- W3 Eden, Inc. WordPress Download Manager
- CWE-646