Alertas de Seguridad de la Información

S Alto vulnerabilidad

08/07/2026

[CVE-2026-59725] Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before …

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

08/07/2026

[CVE-2026-59724] Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before …

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2024-58352] Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attac…

Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input sanitization in the string-concatenated filter expression passed to the Hibernate findList() call to extract se…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-9834] The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is …

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/ad…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-8441] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' p…

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeri…

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

30/06/2026

[CVE-2026-53433] fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --list…

fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-34597] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.470, a critical Authenticated Host Remote Code Execution (RCE) vulnerability was discovered in Coolify. The flaw resides in the handling of user-defined build parameters for the Nixpacks build pack. Specifically, the install_command provided by a user is directly concatenated int…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-40524] FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() fu…

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolea…

nvdaltovulnerabilidad CVSS 8.1 NVD

J Crítico vulnerabilidad

28/06/2026

[CVE-2026-49048] The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by …

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Crítico vulnerabilidad

24/06/2026

[CVE-2026-39948] Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, th…

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installatio…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9776] ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability.…

ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeFileToHttpServletResponse method. The issue results from the lack of proper …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9777] ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability al…

ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the restoreDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in…

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9778] ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerabi…

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior …

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9779] ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Exec…

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateWar method. The issue results from an incorrect implementation of c…

nvdaltovulnerabilidad CVSS 7.2 NVD

C Crítico vulnerabilidad

24/06/2026

[CVE-2026-39893] Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, th…

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed …

nvdcriticovulnerabilidad CVSS 9.8 NVD

D Alto vulnerabilidad

24/06/2026

[CVE-2026-44020] Docling simplifies document processing by parsing diverse formats and providing integrations with th…

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could read arbitrary fi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-12242] The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions…

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before concatenation into a PHP code string wrapped in W3 Total Cache mfunc or Borlabs Cache fragment markers. This make…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9643] The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting vi…

The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER['HTTP_HOST']` with the raw `$_SERVER['REQUEST_URI']` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-35018] NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code ex…

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the username JSON parameter processed by the dalStorage_addUserAccount function. Attackers can exploit the unsafe concatenation of user-supplied input into a shell c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-54419] claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commi…

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation, without sanitization, escaping,…

nvdcriticovulnerabilidad CVSS 9.8 NVD