Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/08/2026

Inyección SQL alta en Task Management System 1.0 permite acceso remoto a bases de datos

Se ha identificado una vulnerabilidad de inyección SQL en code-projects Task Management System 1.0 a través del parámetro task_id en el archivo /user/comment_count_user.php. Esta falla permite a atacantes remotos comprometer la integridad y confidencialidad de datos, siendo especialmente alta para empresas en LATAM que gestionan información sensible de proyectos. El exploit ha sido divulgado públicamente, aumentando el riesgo inmediato de explotación.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/08/2026

Inyección SQL alta en Task Management System 1.0 de code-projects

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-19343, CVSS 7.3) en code-projects Task Management System 1.0 a través del archivo /admin/AdminLogin.php. Un atacante remoto puede manipular los parámetros de email/password para ejecutar comandos SQL arbitrarios y comprometer la integridad de bases de datos. El exploit está disponible públicamente, lo que aumenta significativamente el riesgo para empresas mexicanas y latinoamericanas que utilizan este sistema.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/08/2026

Vulnerabilidad alta de autenticación en Task Management System 1.0 de code-projects

Se detectó una vulnerabilidad de autenticación deficiente en el componente Login del archivo /index.php en Task Management System 1.0 de code-projects, permitiendo manipulación del parámetro Password para eludir la autenticación de forma remota. El exploit está públicamente disponible y afecta potencialmente a sistemas de gestión de tareas desplegados en infraestructuras empresariales de LATAM. Con CVSS 7.3, requiere atención inmediata en organizaciones que utilicen esta plataforma.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19231] A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vu…

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19211] A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown functio…

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

SQL Injection alta en SourceCodester Photo Share Website 1.0

Se identificó una vulnerabilidad de inyección SQL en SourceCodester Photo Share Website 1.0 mediante la manipulación del parámetro email en /social/ajax.php?action=login. El exploit es de acceso público y permite a atacantes remotos comprometer bases de datos de aplicaciones web en empresas mexicanas y latinoamericanas que utilizan esta plataforma. Con CVSS 7.3, representa un riesgo considerable para la confidencialidad e integridad de datos de usuarios.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-16258] The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrust…

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-16263] The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX ac…

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-71488] league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2…

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-63725] sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around …

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() a…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-11976] The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) wa…

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retai…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65575] Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

Unauthenticated PHP Object Injection in Accalia

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65576] Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

Unauthenticated PHP Object Injection in Adrena

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65577] Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

Unauthenticated PHP Object Injection in Advice

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65578] Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

Unauthenticated PHP Object Injection in Agora

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65579] Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

Unauthenticated PHP Object Injection in Agricola

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65581] Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.

Unauthenticated PHP Object Injection in AI ANN

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65571] Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

Unauthenticated PHP Object Injection in 69 Clothing

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65572] Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

Unauthenticated PHP Object Injection in A.Williams

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65573] Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

Unauthenticated PHP Object Injection in Abelle

nvdcriticovulnerabilidad CVSS 9.8 NVD