Vulnerabilidades — Alertas SI

A Alto vulnerabilidad

09/06/2026

[CVE-2026-34693] Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflecte…

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Exploitation of this…

A Crítico vulnerabilidad

09/06/2026

[CVE-2026-34691] Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored C…

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control…

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47631] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47634] Improper neutralization of special elements in output used by a downstream component ('injection') i…

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45644] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Li…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45481] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41098] Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack …

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41031] A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Bui…

A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application. This enables attackers to steal administrative access tokens and session credentials.

V Alto vulnerabilidad

09/06/2026

[CVE-2026-41845] Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code…

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

M Alto vulnerabilidad

09/06/2026

[CVE-2026-7556] The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requ…

V Alto vulnerabilidad

08/06/2026

[CVE-2026-41722] VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A m…

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

V Alto vulnerabilidad

08/06/2026

[CVE-2026-41723] VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A m…

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

V Alto vulnerabilidad

08/06/2026

[CVE-2026-41724] VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A m…

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

M Alto vulnerabilidad

08/06/2026

[CVE-2023-54351] WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows u…

WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.

M Alto vulnerabilidad

06/06/2026

[CVE-2026-8901] The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin f…

The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Submission Data in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute …

M Alto vulnerabilidad

06/06/2026

[CVE-2026-8438] The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored …

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disa…

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50231] Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in t…

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to exe…

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50232] Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers…

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure…

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41518] Chartbrew is an open-source web application that can connect directly to databases and APIs and use …

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In versions 4.9.0 through 5.0.0, an authenticated user with project-editor permissions can store arbitrary HTML/JavaScript in the `ChartDatasetConfig.legend` field. The payload is persisted verbatim in the database, propagated through the Chart.js rendering pipeline, and i…

M Alto vulnerabilidad

04/06/2026

[CVE-2025-67448] The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The …

The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize user input in SMS messages before storing and displaying them. An attacker can send an SMS containing a malicious XSS payload, which will be executed in the context of the victim's browser when the message is viewed.

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?