Alertas de Seguridad de la Información

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72839] filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is ena…

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16961] IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafte…

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17220] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify a…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72741] Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function tha…

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta de inyección NoSQL en Budibase anterior a 3.40.0

Budibase versiones anteriores a 3.40.0 contiene una vulnerabilidad de inyección NoSQL en su integración con MongoDB que permite a atacantes inyectar operadores MongoDB a través de parámetros de consulta, eludiendo controles de acceso por usuario. Los atacantes pueden leer documentos arbitrarios, ejecutar JavaScript malicioso y modificar datos en bases de datos MongoDB conectadas. Esta vulnerabilidad afecta principalmente a empresas en LATAM que utilizan Budibase para desarrollo de aplicaciones internas y plataformas de datos sin validación de entrada robusta.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

Inyección NoSQL alta en Budibase Server anterior a v3.40.0 afecta consultas MongoDB

Budibase Server versiones anteriores a 3.40.0 contienen una vulnerabilidad de inyección NoSQL en el endpoint de ejecución de consultas MongoDB. Atacantes con permisos de escritura de consultas pueden manipular parámetros JSON sin sanitizar, alterando queries para leer, modificar o eliminar documentos arbitrarios. El riesgo es alta (CVSS 8.3) en entornos que exponen esta funcionalidad a usuarios no confiables o integran Budibase en plataformas empresariales en LATAM.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73326] CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privile…

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to al…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-17111] IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially c…

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16494] GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 …

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-19311] Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an…

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-14478] A maliciously created executable, when executed on the victim's machine, may allow a local low-privi…

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48771] ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could poten…

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive database rules may allow unauthorised users to read, modify, or abuse stored form submission data. This coul…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/08/2026

Inyección SQL alta en Pimcore admin-ui-classic-bundle afecta gestión de contenidos

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-72562) en Pimcore admin-ui-classic-bundle versión 2.3 y anteriores que permite a usuarios autenticados ejecutar comandos SQL arbitrarios a través del filtro de columna ID en la grilla DataObject. Un atacante con acceso al backend puede exfiltrar, modificar o eliminar bases de datos completas sin validación paramétrica. Esto afecta especialmente a medianas y grandes empresas en LATAM que utilizan Pimcore para gestión de activos digitales y catálogos de productos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

Vulnerabilidad alta de control de acceso en BadChoice Handesk permite modificación no autorizada de tickets

BadChoice Handesk presenta una falla de control de acceso (CVSS 8.1) que permite a cualquier agente autenticado modificar, escalar o corromper tickets asignados a otros equipos a través del endpoint TicketsController@update. El endpoint carece de validación de autorización y no verifica la propiedad de los registros por equipo, exponiendo la integridad operativa de centros de soporte en LATAM que utilicen esta plataforma.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

11/08/2026

Inyección SQL crítica en e107 2.4.0 permite acceso no autenticado a bases de datos

Una vulnerabilidad de inyección SQL en e107 2.4.0 permite a atacantes no autenticados ejecutar comandos SQL arbitrarios a través del parámetro de ID de noticia, comprometiendo completamente la integridad de la base de datos. Los atacantes pueden leer, modificar o eliminar todos los contenidos, incluidas credenciales de administrador. Esta falla afecta directamente a portales de contenidos, sitios informativos y plataformas comunitarias desplegadas en LATAM sin parches aplicados.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

Vulnerabilidad alta de control de acceso en Peppermint Lab Peppermint (CVE-2026-72555)

Peppermint Lab Peppermint presenta una vulnerabilidad de control de acceso roto en instalaciones por defecto, donde el flag Config.roles_active está deshabilitado, permitiendo que todos los usuarios autenticados eludan controles de propiedad y acceso administrativo. Un atacante con cualquier cuenta de usuario puede leer, modificar o eliminar tickets, datos de clientes e información de otros usuarios. Afecta altas sistemas de gestión de tickets en empresas mexicanas y latinoamericanas que usan esta solución.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72546] An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any aut…

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. An attacker can modify event data and financial records a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-72550] An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated re…

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-19425] Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability…

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-19424] Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability.…

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.

nvdaltovulnerabilidad CVSS 7.5 NVD