Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/08/2026

Eliminación arbitraria de archivos sin autenticación en ShopBuilder Pro ≤ 2.2.0

ShopBuilder Pro, extensión de Elementor para WooCommerce, presenta una vulnerabilidad alta (CVSS 8.6) que permite a atacantes no autenticados eliminar archivos arbitrarios del servidor. Afecta directamente a tiendas en línea y sitios de comercio electrónico en México y LATAM que utilizan versiones anteriores a 2.2.1. El riesgo es severo: pérdida de datos altas, degradación de servicios y potencial exposición de información sensible.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-28162] Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Events Made Easy

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-28166] Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Tourmaster

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78245] A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_upl…

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78244] A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this iss…

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-10582] Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRem…

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actua…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-75931] fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input …

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-75975] fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validat…

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, whic…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78314] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78315] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78316] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78317] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-66897] A path traversal vulnerability in LXD's instance template processing allows an attacker with contain…

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-75899] fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and th…

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78202] A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting…

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78201] A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the funct…

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78199] A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is a…

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78198] A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0.…

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Such manipulation of the argument pid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-59561] Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulne…

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal".

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78197] A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulner…

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD