Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11472] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /index1.php. This manipulation of the argument Password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11462] A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This imp…

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper authorization. The attack can be initiated remotely. The exploit has been made public and could be used. The pa…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11463] A vulnerability was determined in USCiLab Cereal up to 1.3.2. Affected is an unknown function of the…

A vulnerability was determined in USCiLab Cereal up to 1.3.2. Affected is an unknown function of the component Shared Pointer Handler. Executing a manipulation can lead to type confusion. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11460] A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function…

A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-49494] Xcitium Client Security (XCS) before 13.8.2.10019 and Comodo Internet Security (CIS) through 12.3.4.…

Xcitium Client Security (XCS) before 13.8.2.10019 and Comodo Internet Security (CIS) through 12.3.4.8162 (fix expected by 2026 Q3) contain an integer underflow vulnerability in the firewall driver Inspect.sys that allows remote unauthenticated attackers to crash the system by sending a crafted IPv6 packet with a declared payload length smaller than the sum of its extension-header lengths. The unsi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11456] A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/j…

A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxf_dump_systable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11457] A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2…

A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a manipulation of the argument dbType/dbDriver/dbUrl/dbUsername/dbPassword results in injection. Remote exploitation of the attack is possible.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11451] A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cg…

A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affected component. The vendor explains: "In version…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11452] A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e2…

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected component should be upgraded. The vendor explains: " T…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11450] A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the lib…

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-26422] clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege …

clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-11437] A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of…

A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-11435] A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the…

A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulation of the argument httpOID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-11413] A security vulnerability has been detected in JingDong JD Cloud Box AX6600 4.5.3.r4546. The impacted…

A security vulnerability has been detected in JingDong JD Cloud Box AX6600 4.5.3.r4546. The impacted element is the function set_macfilter of the file /sbin/jdcweb_rpc. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respon…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-9851] The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover …

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-7537] The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all version…

The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executa…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-8901] The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin f…

The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Submission Data in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-8438] The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored …

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disa…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-9290] The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local …

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass acc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-7654] The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code …

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for au…

nvdaltovulnerabilidad CVSS 8.8 NVD