https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:48:34 +0000 https://cve.radiocsirt.org/vuln/cve-2026-14282 <p><strong>Affected:</strong> rtcamp GoDAM – Organize WordPress Media Library &amp; File Manager with Unlimited Folders for Images, Videos &amp; more</p> <p>The GoDAM – Organize WordPress Media Library &amp; File Manager with Unlimited Folders for Images, Videos &amp; more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms&#39; public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem-&gt;move() into a web-served directory — bypassing wp_handle_upload()&#39;s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible.</p> <p><strong>Affected:</strong> rtcamp GoDAM – Organize WordPress Media Library &amp; File Manager with Unlimited Folders for Images, Videos &amp; more</p> <p>The GoDAM – Organize WordPress Media Library &amp; File Manager with Unlimited Folders for Images, Videos &amp; more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms&#39; public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem-&gt;move() into a web-served directory — bypassing wp_handle_upload()&#39;s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible.</p> https://cve.radiocsirt.org/vuln/cve-2026-14282