Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76213] phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step whe…

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76214] phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge gen…

phpMyFAQ before 4.1.7 (affected versions

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76207] phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me to…

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76208] phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::cr…

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to 'active'. As a result, a user whose local phpMyFAQ account has been adminis…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76205] phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpo…

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape the closing quote and inject arbitrary SQL commands to read sensitive database information.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-75918] phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user …

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-73389] Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

Unauthenticated PHP Object Injection in Kalles Addons

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-73364] Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.

Customer PHP Object Injection in Flexible Subscriptions

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad XSS almacenado en plugin TranslatePress para WordPress hasta v3.2.5

El plugin TranslatePress para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado sin autenticación requerida en versiones hasta 3.2.5. Los marcadores especiales '#!trpst#' y '#!trpen#' se reescriben incondicionalmente a caracteres HTML, permitiendo inyección de código malicioso. Afecta principalmente a sitios multilingües en LATAM que utilizan este plugin para traducción de contenidos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18937] The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accep…

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-11565] The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in seve…

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

19/08/2026

Inyección SQL alta en SourceCodester Simple Online Food Ordering System 1.0

Se identificó una vulnerabilidad de inyección SQL en el módulo de administración (/admin/ajax.php?action=delete_menu) del sistema de pedidos en línea SourceCodester versión 1.0. Un atacante remoto puede manipular el parámetro ID para ejecutar comandos SQL arbitrarios, comprometiendo la integridad y confidencialidad de bases de datos de restaurantes y datos de clientes. El exploit está públicamente disponible y afecta directamente a plataformas de delivery y comercio electrónico en LATAM.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/08/2026

Inyección SQL alta en SourceCodester Simple Online Food Ordering System 1.0

Se ha identificado una vulnerabilidad de inyección SQL en el módulo de administración (/admin/ajax.php?action=save_menu) del sistema SourceCodester Simple Online Food Ordering System versión 1.0, permitiendo a atacantes remotos manipular consultas a base de datos mediante el parámetro ID. Esta afecta directamente a restaurantes y negocios de alimentos en LATAM que utilizan esta plataforma para gestionar menús y pedidos online. El exploit está disponible públicamente, elevando significativamente el riesgo de compromisos inmediatos.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/08/2026

Inyección SQL alta en SourceCodester Simple Online Food Ordering System 1.0

Se ha identificado una vulnerabilidad de inyección SQL en SourceCodester Simple Online Food Ordering System 1.0 a través del parámetro Username en /admin/ajax.php?action=login. Un atacante remoto puede ejecutar comandos SQL maliciosos sin autenticación válida, comprometiendo bases de datos de órdenes, clientes y pagos. Esta vulnerabilidad afecta directamente a restaurantes, fondas y servicios de delivery en LATAM que utilicen este sistema de código abierto.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-75986] A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element i…

A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-62988] Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Cu…

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An aut…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-54347] Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accept…

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer …

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-54348] Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.upd…

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel_admins.ip without enforcing numeric element types. When the poisoned account later calls IpsAndPorts.listing, lib/Froxlor/Api/Commands/IpsAndPorts.php decodes the array an…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-52793] Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path i…

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentica…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-49225] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql …

nvdaltovulnerabilidad CVSS 8.3 NVD