Alertas de Seguridad de la Información

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63221] CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()…

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed i…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-43830] Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66421] OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated …

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute with…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-38709] TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300…

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-68502] LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.15…

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-68503] LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.15…

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66418] OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthent…

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive C…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66803] Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a ne…

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-52539] Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environmen…

Outstatic CMS

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-35847] An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping …

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69933] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69934] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69935] CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and reven…

CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69936] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69937] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpo…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69938] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the param…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69941] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=…

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69947] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69930] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-65336] Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price…

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.

nvdcriticovulnerabilidad CVSS 9.8 NVD