Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/08/2026

[CVE-2026-77018] The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s…

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-18080] The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerabl…

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthentic…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80235] EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthe…

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80237] EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authent…

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80233] CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File U…

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-75496] Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before m…

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-16286] Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Comput…

Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-16601] The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vu…

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56702] Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUp…

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-32559] Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.

Subscriber Arbitrary File Upload in UltimateAI

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78245] A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_upl…

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78202] A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting…

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

21/08/2026

Vulnerabilidad crítica de carga de archivos sin restricción en xShop 3.0.3 (CVE-2026-49849)

xShop, plataforma de e-commerce de código abierto basada en Laravel, contiene una vulnerabilidad de carga de archivos sin validación que permite a administradores autenticados subir y ejecutar archivos PHP, logrando ejecución remota de código (RCE) con acceso total al servidor. Afecta directamente a tiendas en línea operadas por pequeñas y medianas empresas en LATAM. La versión 3.0.4 corrige el problema.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/08/2026

Carga arbitraria de archivos en IT Residence <= 3.2.1 (CVE-2026-74014)

Vulnerabilidad crítica (CVSS 9.9) en IT Residence versiones 3.2.1 y anteriores permite a suscriptores cargar archivos arbitrarios en servidores afectados. Esta falla expone sistemas de gestión inmobiliaria, comunes en empresas de administración de propiedades y desarrolladores en México y Latinoamérica, a ejecución remota de código y compromiso total de infraestructura.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

20/08/2026

Carga arbitraria de archivos en Smart Cleaning ≤ 4.8.6 afecta suscriptores

Se reporta una vulnerabilidad crítica (CVSS 9.9) en Smart Cleaning versiones 4.8.6 y anteriores que permite a usuarios suscritos cargar archivos arbitrarios en servidores. Esta falla compromete la integridad de sistemas y facilita inyección de malware en infraestructuras empresariales de LATAM. Afecta especialmente a empresas que utilizan esta plataforma para gestión de servicios de limpieza en múltiples sedes.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

20/08/2026

Carga arbitraria de archivos en Warehouse Cargo <= 2.6.9 (CVE-2026-74018)

Warehouse Cargo en versiones 2.6.9 y anteriores contiene una vulnerabilidad crítica (CVSS 9.9) que permite a usuarios suscritos cargar archivos arbitrarios en sistemas afectados. Esta falla expone servidores en México y Latinoamérica a compromiso total de integridad de datos y ejecución de código remoto en infraestructuras logísticas y de almacenamiento.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-66600] Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.

Author Arbitrary File Upload in Media LIbrary Assistant

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-14946] A high privileged remote attacker can upload a .php file and then request it directly from /uploads/…

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-15049] The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a …

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-68899] Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation…

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=tr…

nvdaltovulnerabilidad CVSS 8.7 NVD