Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/09/2026

Vulnerabilidad de credenciales codificadas en SourceCodester Syllabus-Aligned LMS 1.0

Se ha identificado una falla de seguridad alta en SourceCodester Syllabus-Aligned Learning Management & Examination System versión 1.0 que expone credenciales codificadas en el archivo db.php. La vulnerabilidad permite acceso remoto sin autenticación y exploits públicos ya están disponibles. Instituciones educativas y organizaciones en LATAM que utilicen este sistema están en riesgo inmediato de comprometer datos académicos y administrativos.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86273] A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the func…

A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86272] A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.600…

A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86268] A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown fu…

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86263] A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. …

A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now publi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86261] A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8…

A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86262] A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d6…

A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation of the argument userID/id leads to authorization bypass. The attack is possible to be carried out rem…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86225] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by …

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqli_query of the file /admin/modal_add_room.php. The manipulation of the argument room_name leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86224] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is …

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86222] A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects…

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. Such manipulation of the argument course leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86223] A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the …

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli_query of the file /admin/modal_add_coursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86221] A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element …

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86220] A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected e…

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqli_query of the file /admin/modal_add_course.php. The manipulation of the argument course results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-19633] PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbi…

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86213] A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mys…

A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search Handler. The manipulation of the argument book_name/book_author results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

[CVE-2026-86214] A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown functio…

A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad alta en PocketMine-MP anterior a 4.7.2 permite negación de servicio

PocketMine-MP versiones anteriores a 4.7.2 no maneja adecuadamente excepciones de la librería adhocore/json-comment al procesar datos de geometría de skins. Atacantes pueden enviar paquetes de inicio de sesión o skin malformados para provocar una excepción no controlada que causa el colapso del servidor. Este fallo afecta directamente a servidores de juego en México y Latinoamérica que dependen de PocketMine-MP para Minecraft Pocket Edition.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad alta en Bifrost HTTP transport permite ejecución de código remoto sin autenticación

Bifrost HTTP transport anterior a versión 2.0.0 permite a atacantes no autenticados cargar y ejecutar plugins maliciosos a través de POST /api/plugins cuando la autenticación de gestión está deshabilitada (configuración por defecto). El cargador de objetos compartidos descarga archivos desde URLs HTTP y los ejecuta como librerías dinámicas en Go, comprometiendo completamente servidores en infraestructuras altas de LATAM. Afecta especialmente a plataformas de integración y orquestación de datos sin hardening de seguridad.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad de denegación de servicio en h3 anteriores a 2.0.1-rc.18

h3 versiones anteriores a 2.0.1-rc.18 no validan correctamente el conteo de fragmentos en cookies controladas por el usuario, permitiendo que atacantes envíen headers de cookie malformados con conteos extremadamente grandes. Esto dispara un bucle de limpieza O(n²) que congela el proceso del servidor, causando indisponibilidad de servicios web altas en empresas LATAM. El impacto afecta principalmente a aplicaciones que procesan cookies en escala, como plataformas e-commerce y sistemas de sesión.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/09/2026

Inyección SQL alta en rabindralamsal inventory-management-system 1.0.0

Se ha identificado una vulnerabilidad de inyección SQL en el componente de Login del archivo index.php en rabindralamsal inventory-management-system versión 1.0.0. Un atacante remoto puede manipular los parámetros username/password para ejecutar comandos SQL no autorizados. La vulnerabilidad tiene puntuación CVSS 7.3 y su exploración ha sido publicada, aumentando el riesgo inmediato para sistemas en producción en LATAM que utilicen esta solución de gestión de inventarios.

nvdaltovulnerabilidad CVSS 7.3 NVD