Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/08/2026

[CVE-2026-27380] Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Editor PHP Object Injection in Car Rental Manager

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-49827] WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1…

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chai…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73327] Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a…

Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be wr…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-47231] Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-file…

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18391] The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unse…

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-15039] The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of i…

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-55676] Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) a…

Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is ac…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-13457] The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Co…

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-46670] YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection i…

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-72748] AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json…

AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achiev…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72556] A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute…

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-b…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72557] An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload …

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The allowed_uploads configuration defaults to wildcard (*) and uploaded files are stored in a web-accessible directory. An attacker with any authenticated account can upload a PHP webshell and execute arbitrary OS commands o…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72551] A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Devel…

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system(), enabling a developer to escape the sandbox and gain OS command execution on the server. An attacker with a Developer-role account can …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-69118] Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template re…

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-66738] SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navig…

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET reque…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-63106] ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product l…

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents,…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/08/2026

Vulnerabilidad crítica de carga de archivos sin restricciones en phpfm 1.8.0 permite ejecución remota de código

phpfm versiones hasta 1.8.0 contiene una vulnerabilidad crítica (CVSS 9.8) que permite a atacantes no autenticados cargar archivos PHP arbitrarios y ejecutar código en el servidor. La aplicación viene configurada por defecto sin filtros de extensión de archivo y sin autenticación habilitada, exponiendo servidores web en México y Latinoamérica que utilicen este gestor de archivos. Esta vulnerabilidad permite compromiso total del servidor.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/08/2026

Vulnerabilidad crítica de autenticación en phpfm 1.8.0 permite acceso no autorizado al sistema de archivos

phpfm versión 1.8.0 y anteriores contiene una vulnerabilidad de autenticación faltante que permite a atacantes remotos sin credenciales acceder completamente al gestor de archivos del servidor. Los atacantes pueden leer, escribir, eliminar y cargar archivos en cualquier parte del sistema de archivos, comprometiendo la integridad y confidencialidad de datos críticos. Esta vulnerabilidad afecta directamente a empresas en LATAM que utilizan esta herramienta para administración de servidores web.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19384] A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected…

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19376] A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function…

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue repor…

nvdaltovulnerabilidad CVSS 7.3 NVD