Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/09/2026

[CVE-2026-19887] The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up…

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chose…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-15984] The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Para…

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-16649] The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Fi…

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

05/09/2026

[CVE-2026-83627] The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulner…

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leadi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-86145] PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace …

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set throug…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

05/09/2026

[CVE-2026-13447] The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versio…

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT sig…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-77233] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execu…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-77263] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-86140] In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-52775] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest developm…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterizatio…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

05/09/2026

[CVE-2026-52766] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki ac…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-52767] YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureSe…

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1)…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-52769] YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/f…

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature() parses the header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification or URL val…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-52770] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listin…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validation. An unauthenticated attacker can inject bool…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/09/2026

[CVE-2026-52771] YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::…

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privileg…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-86095] Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attnam…

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-86098] ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_e…

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-48019] Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vuln…

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patche…

nvdaltovulnerabilidad CVSS 8.9 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-75925] Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker…

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-77393] In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which pe…

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

nvdaltovulnerabilidad CVSS 8.8 NVD