Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Joomla" — 90 resultados ✕ Limpiar búsqueda
13,509
Total alertas
3066
Críticas
10171
Altas
8
Ransomware
1810
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
J Crítico vulnerabilidad
28/06/2026
[CVE-2026-49048] The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by …
The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2023-54357] Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unau…
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses …
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25761] Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated at…
Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id parameter. Attackers can send GET requests to index.php with option=com_joomcrm&view=contacts and inject SQL code in the deal_id parameter to extract sensitive database information including table names and sche…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25762] Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows u…
Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25755] Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated …
Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cmId parameter. Attackers can send POST requests to the editReview task endpoint with URL-encoded SQL UNION statements in the cmId parameter to extract database information including usernames, passwords, and database…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25756] Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated…
Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25757] Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers t…
Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vproductid and userid parameters. Attackers can send POST requests to the component with crafted SQL payloads in these parameters to extract sensitive database information including version and database names.
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25758] Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authent…
Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25759] Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated atta…
Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database nam…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25750] Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allow…
Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column …
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25751] Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unau…
Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the categorySearch, adType, and citySearch parameters to the displayads component to extract sensitive database information including usernames, da…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25752] Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unau…
Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=com_jbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to e…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25753] Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated att…
Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25754] Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticat…
Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keysearch parameter. Attackers can send POST requests to the menu-listing-layout endpoint with crafted SQL payloads in the keysearch parameter to extract database table names and sensitive information from the data…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2019-25749] Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attack…
Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the guest_adult parameter. Attackers can send POST requests to the cruises endpoint with crafted SQL payloads in the guest_adult parameter to extract sensitive database information or manipulate database records.
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20278] Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticate…
Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the category parameter. Attackers can send GET requests to the all-recipes endpoint with malicious SQL payloads in the category path segment to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20279] Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to …
Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the aid parameter. Attackers can send GET requests to index.php with malicious aid values in the make_payment task to extract sensitive database information using boolean-based blind or time-based blind techniques.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20280] Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticat…
Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid endpoint to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20281] Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthentic…
Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the establename parameter. Attackers can send GET requests to index.php with the option=com_extrasearch parameter and malicious SQL in the establename field to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20282] Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthe…
Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD