Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/06/2026

[CVE-2017-20250] Mac Photo Gallery 3.0 contains a path traversal vulnerability that allows unauthenticated attackers …

Mac Photo Gallery 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the albid parameter. Attackers can send requests to macdownload.php with directory traversal sequences to access sensitive files like wp-load.php outside the intended plugin directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2016-20063] Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated user…

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to extract sensitive database information including user credentials and site configuration data.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2016-20065] Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unaut…

Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2017-20243] WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerab…

WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2016-20062] Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthent…

Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the 'pollid' POST parameter. Attackers can send requests to the admin-ajax.php endpoint with the 'spAjaxResults' action and malicious 'pollid' values to execute arbitrary SQL queries and read sensitive data from the WordP…

nvdaltovulnerabilidad CVSS 8.2 NVD

S Alto vulnerabilidad

09/06/2026

[CVE-2026-46746] A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application…

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbit…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

09/06/2026

[CVE-2026-46748] A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected sy…

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access. This could allow a local attacker to escalate privileges leading to arbitrary file modification an…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

09/06/2026

[CVE-2026-46749] A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected ap…

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentia…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41031] A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Bui…

A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application. This enables attackers to steal administrative access tokens and session credentials.

nvdaltovulnerabilidad CVSS 8.7 NVD

S Alto vulnerabilidad

09/06/2026

[CVE-2026-24349] A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC …

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of k…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2025-10263] Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Co…

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-8365] The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Executi…

The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '' and does not prevent serialized PHP obj…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11616] The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in v…

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2009-10007] Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixatio…

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.

nvdcriticovulnerabilidad CVSS 9.1 NVD

Z Alto vulnerabilidad

09/06/2026

[CVE-2026-5068] A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host du…

A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/ho…

nvdaltovulnerabilidad CVSS 7.6 NVD

P Crítico vulnerabilidad

09/06/2026

[CVE-2026-9698] DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were…

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow.

nvdcriticovulnerabilidad CVSS 9.8 NVD

Q Crítico vulnerabilidad

09/06/2026

[CVE-2026-44083] An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagi…

An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11572] Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command In…

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

nvdaltovulnerabilidad CVSS 8.8 NVD

Z Crítico vulnerabilidad

09/06/2026

[CVE-2026-5067] A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket u…

A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bounded copy that does not guarantee NUL termination when the input length reaches the buffer size. During upgrade handling the buffer is copied to a local stack buf…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-9185] The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Control…

The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.22.0 via the `userId` parameter of the `six_storage_get_user_info` and `six_storage_update_profile` AJAX actions. This is due to the `six_storage_getUserInfo()` and `six_storage_updateProfile()` functions being registered on `wp_ajax_nopriv_*` hooks and …

nvdaltovulnerabilidad CVSS 7.5 NVD