Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90846] A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknow…

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90844] A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affe…

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90841] A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by thi…

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be u…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90840] A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the func…

A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90805] A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07e…

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54182] backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of …

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which i…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54175] backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of …

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model inste…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54178] backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of …

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_[] and passes them to Storage::disk()->delete without confirming t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-61701] Laravel MagicLink creates links for authentication without a password or for accessing private conte…

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachabl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-55416] Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026…

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these val…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-55072] Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated…

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/D…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90789] A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue i…

A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

Inyección SQL alta en Yot CMS hasta versión 3.3.1 — CVE-2026-90708

Se identificó una vulnerabilidad de inyección SQL en el manejador de cookies de Yot CMS versión 3.3.1 y anteriores. El parámetro yot3_user/yot3_pass en la función Login del archivo global.php permite ataques remotos sin autenticación. El exploit público incrementa el riesgo para sitios web y portales corporativos en LATAM que usan esta plataforma.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

Inyección SQL alta en online-clinic-management-system afecta sistemas de salud

Se detectó una vulnerabilidad de inyección SQL en el archivo listdoctor.php del sistema online-clinic-management-system (hasta versión e9ee77a8827a1446220fa07ee693dc4d9a29a578) que permite manipulación remota del parámetro searchtext. El exploit es público y activo. Clínicas y sistemas de gestión médica en México y LATAM que utilizan este software están expuestos a acceso no autorizado a datos de pacientes y médicos.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90566] A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5…

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function createUserAccount of the file register.php of the component Registration Handler. Executing a manipulation of the argument usertype can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90526] A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0.…

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/09/2026

Vulnerabilidad alta de inyección SQL en SourceCodester School Registration and Fee System 1.0

Se identificó una vulnerabilidad de inyección SQL en SourceCodester School Registration and Fee System 1.0 que afecta el archivo /bilal/normal/delete_stud.php. Un atacante remoto puede manipular el parámetro selector[] para ejecutar comandos SQL arbitrarios y comprometer bases de datos de instituciones educativas. La vulnerabilidad tiene CVSS 7.3 y exploits públicos disponibles, representando riesgo inmediato para sistemas de registro y gestión de matrículas en centros educativos de LATAM.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/09/2026

Inyección SQL alta en SourceCodester School Registration and Fee System 1.0

Se identificó una vulnerabilidad de inyección SQL en SourceCodester School Registration and Fee System 1.0 en el archivo /bilal/normal/pay_report.php, permitiendo manipulación del parámetro 'period' para ejecutar comandos SQL arbitrarios. El exploit es público y explotable remotamente, afectando directamente instituciones educativas en México y LATAM que utilizan este sistema para gestión de matrículas y cobros. Con CVSS 7.3, requiere acción inmediata en entornos de producción.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/09/2026

Inyección SQL alta en SourceCodester School Registration and Fee System 1.0

Se ha identificado una vulnerabilidad de inyección SQL en SourceCodester School Registration and Fee System versión 1.0, específicamente en el archivo /bilal/normal/save_stud.php. Un atacante remoto puede manipular el parámetro Status para ejecutar comandos SQL maliciosos y comprometer la base de datos de estudiantes y registros académicos. Esta vulnerabilidad es especialmente alta para instituciones educativas en México y LATAM que utilizan este sistema para gestionar matrículas y cobros de colegios.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90495] A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function…

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted…

nvdaltovulnerabilidad CVSS 7.3 NVD