Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/10/2026

[CVE-2026-103305] The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when sav…

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108522] A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the …

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990a…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

11/10/2026

[CVE-2026-108707] Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect tha…

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108708] Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAsp…

Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108693] ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerabi…

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108695] MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that …

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-108657] JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController pa…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-108628] JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-108623] JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delet…

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-78533] Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

Unauthenticated PHP Object Injection in Qwery

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-78534] Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Educavo

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-78535] Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Unauthenticated PHP Object Injection in Photolia

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-81797] Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 …

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-66566] Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

Unauthenticated Local File Inclusion in Ambient

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-66567] Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

Unauthenticated PHP Object Injection in Anesta

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-66568] Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

Unauthenticated PHP Object Injection in Original

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-66569] Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

Unauthenticated PHP Object Injection in Kicker

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-78529] Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

Unauthenticated PHP Object Injection in Alliance

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-78530] Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

Subscriber Arbitrary File Deletion in FoodBakery

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-78531] Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Unauthenticated PHP Object Injection in Jacqueline

nvdcriticovulnerabilidad CVSS 9.8 NVD