Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97882] A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6…

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97883] A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec09…

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is use…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97885] A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3…

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-50547] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequenc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-62262] Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earl…

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-cas…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-39353] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as publi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-42322] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-42323] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-42324] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.in…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-44642] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrade…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97865] A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Even…

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

Escalación de privilegios alta en plugin Optima Express IDX para WordPress hasta v8.7.5

El plugin Optima Express IDX para WordPress contiene una vulnerabilidad de escalación de privilegios (CVSS 7.3) que permite a atacantes no autenticados ejecutar funciones administrativas a través de la acción AJAX `wp_ajax_nopriv_ihf_clear_cache`. La vulnerabilidad afecta todas las versiones hasta la 8.7.5 y expone sitios inmobiliarios y portales empresariales en México y LATAM que utilizan este plugin. Un atacante podría comprometer credenciales de autenticación y obtener acceso administrativo completo.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

Ejecución remota de código alta en plugin s2Member para WordPress (CVE-2026-19804)

El plugin s2Member para WordPress presenta una vulnerabilidad alta (CVSS 8.8) de ejecución remota de código en versiones hasta 260814. La validación insuficiente del parámetro 'first_name' permite a atacantes ejecutar código PHP arbitrario en servidores vulnerables. Afecta directamente a plataformas de membresías, paywalls de contenido y sistemas de suscripción implementados en sitios web de empresas en México y LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

Vulnerabilidad de Inclusión de Archivos Locales en Plugin WP Maps para WordPress

El plugin WP Maps (versiones hasta 4.9.8) presenta una vulnerabilidad de Local File Inclusion (LFI) que permite a atacantes autenticados con acceso de suscriptor ejecutar archivos PHP arbitrarios en el servidor mediante el parámetro 'page'. Esta falla afecta directamente a sitios WordPress que utilizan este plugin en México y LATAM para gestionar ubicaciones de tiendas y directorios, comprometiendo la integridad del servidor y acceso a datos sensibles.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97818] phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/…

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97735] ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php)…

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97730] In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulne…

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can subm…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97646] A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca5…

A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-61815] zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear librar…

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header injection (CWE-93) affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment f…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-61816] zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear librar…

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent …

nvdaltovulnerabilidad CVSS 7.5 NVD