Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58452] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory SetMAC endpoint. Attackers can craft a string beginning with a valid MAC-like prefix followed by a semicolon and a shell payload, which bypas…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-58453] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credential…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin username with an empty password accepted by the anyka_ipc HTTP service on port 80. Attackers can authenticate with these hardcoded credentials to access camera snapshots, video streams, netw…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58454] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the c…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-54399] Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpCompone…

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34116] Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.p…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without sanitization: exec(\"php jobs/transcribe.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34117] Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subt…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19) without sanitization: exec(\"php jobs/text_to_subtitles.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34109] Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without sanitization: exec(\"php jobs/speech_audio.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34110] Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_star…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/complex.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34111] Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_te…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34112] Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.ph…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34113] Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34114] Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_te…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) without sanitization: exec(\"php jobs/translate_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34115] Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_a…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15) without sanitization: exec(\"php jobs/transcribe_amazon.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34101] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34102] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_i…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34103] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subti…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34104] Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in des…

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34105] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in trans…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34106] Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.ph…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to the id parameter to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34107] Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.ph…

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without sanitization: exec(\"php jobs/translate.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD