Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20282] Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthe…

Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20270] Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated …

Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username and id parameters. Attackers can send GET requests to index.php with option=com_twitchtv and view parameters containing SQL injection payloads to extract sensitive database information including credentials a…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20273] Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows una…

Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_registrationpro&view=category&id parameter containing SQL injection payloads to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20274] Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthentic…

Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cp_id parameter. Attackers can send GET requests to index.php with the option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath parameters to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20276] Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthentic…

Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the type parameter. Attackers can send GET requests to index.php with the option=com_simgenealogy, view=latest parameters and inject malicious SQL in the type parameter to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20277] Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author …

Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on the search results page. Attackers can inject SQL code through POST requests to the search endpoint to extract database information using boolean-based blind SQL injection techniques.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20263] Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unau…

Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_focalpoint, view=location, and a crafted id parameter containing SQL commands to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20264] Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticat…

Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_sponsorwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information including crede…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20265] Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated …

Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_flipwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20257] Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthentica…

Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the ajaxaction.flag_question task. Attackers can inject malicious SQL code via the stu_quiz_id or flag_quest parameters to manipulate database queries and extract sensitive information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20254] Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated…

Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with the option=com_userbench&view=detail&userid parameter containing SQL injection payloads to extract sensitive database information including credenti…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

19/06/2026

[CVE-2026-52909] In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on…

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device i…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2023-54353] Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that…

Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files (x86)\Personify\ can place a malicious Program.exe or PsyFrameGrabberService.exe file that executes with LocalSy…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20095] Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastVi…

Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can place a malicious executable in the Program Files directory with a crafted name to be executed by the service during startup, gaining elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25747] Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path that…

Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path that allows local attackers to escalate privileges by placing malicious executables in intermediate directories. Attackers can exploit the unquoted path in the service configuration to execute arbitrary code with LocalSystem privileges when the service starts or restarts.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20089] Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to exec…

Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. When installed from directories containing spaces, attackers can place malicious executables in the path to be executed with elevated privileges during service startup or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20090] Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in th…

Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path running with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20085] Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that…

Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Crítico vulnerabilidad

19/06/2026

[CVE-2026-9142] There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is n…

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauthenticated user access to the server on the local network.  This affects NI grpc-device 2.17.0 and prior versions.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-48895] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker co…

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.2 NVD