Alertas de Seguridad de la Información

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-14808] Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerabili…

Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the database account and password.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-6382] The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4…

The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have th…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-11766] The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value …

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-11855] The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webho…

The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-11962] The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its f…

The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-12083] The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro Wor…

The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-14802] A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the functi…

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue repo…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2024-6228] The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user…

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-10830] The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a pub…

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-14778] A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management…

A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14772] A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The im…

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_course1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14771] A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected el…

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the file /edit_exam1.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14769] A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affe…

A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affects some unknown processing of the file /pay.php. Such manipulation of the argument Bankname leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14770] A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an…

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_room.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14768] A weakness has been identified in code-projects Real State Services 1.0. This vulnerability affects …

A weakness has been identified in code-projects Real State Services 1.0. This vulnerability affects unknown code of the file /builderHome.php. This manipulation of the argument loc causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14763] A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. This affects an unknown fu…

A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. This affects an unknown function of the file /admin/tour_reserves.php of the component Tour Reservations Page. This manipulation of the argument tour causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14764] A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. This impacts an u…

A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. This impacts an unknown function of the file /admin/add_event.php of the component Event Management Page. Such manipulation of the argument fdetails leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14762] A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted elemen…

A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the file /admin/rooms.php of the component Room Management Page. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-6509] Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardu…

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects Pardus Update: from

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-9085] Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBI…

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from

nvdaltovulnerabilidad CVSS 8.8 NVD