Alertas de Seguridad de la Información

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84082] IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands du…

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84064] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary S…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84073] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary S…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81933] IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Gri…

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to sensitive data and impact to the confidentiality, integrity, and availability of the affected system.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-80441] IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vul…

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81626] IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balance…

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81656] IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Bu…

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61820] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-61781] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61817] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder fu…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61818] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that inv…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61819] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the lite…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-17619] IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL …

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2021-48008] Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to …

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was firs…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2023-54399] Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint…

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation eviden…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2019-25776] Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers…

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including admi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93591] SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt funct…

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across n…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-85705] The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and …

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already ex…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-18442] The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to…

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append add…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-67100] HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure fla…

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

nvdcriticovulnerabilidad CVSS 9.8 NVD