Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100636] SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoi…

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100637] SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint th…

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100639] SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (…

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100623] Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase Pos…

Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization (public.check_min_rights('admin', ...)); they do not require a pending invitation in tmp_users, acceptance of an invite …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100625] Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/…

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privil…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100615] Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowin…

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100617] Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the org…

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100610] Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history withou…

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selected solely by an attacker-supplied chatflowid, and patchDeleteUpsertHistory() deletes rows by an attacker-supplied array of record UUIDs. As a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100612] Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.…

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_map…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100607] Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider…

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local passw…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100315] A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c…

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

Inyección SQL alta en CloudClassroom-PHP-Project afecta plataformas educativas

Se ha identificado una vulnerabilidad de inyección SQL en CloudClassroom-PHP-Project (hasta versión 5dadec098bfbbf3300d60c3494db3fb95b66e7be) que permite manipular el parámetro 'eno' en el archivo updatedetailsfromstudent.php. El ataque es remotamente explotable y el exploit ha sido divulgado públicamente. Instituciones educativas y plataformas de aprendizaje en LATAM que usen este software están en riesgo inmediato de comprometimiento de bases de datos estudiantiles.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-96532] The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership ch…

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

26/09/2026

Vulnerabilidad crítica de carga arbitraria de archivos en plugin Request a Quote for WooCommerce

El plugin Request a Quote for WooCommerce para WordPress es vulnerable a carga arbitraria de archivos en versiones hasta la 2.9.2 debido a validación insuficiente de extensiones y tipos MIME en la función afrfq_submit_quote_via_popup(). Un atacante puede cargar archivos maliciosos (como shells PHP) directamente al servidor sin restricción, comprometiendo completamente sitios de comercio electrónico en LATAM. Con CVSS 9.8, afecta principalmente a pequeñas y medianas empresas que usan este plugin para gestionar cotizaciones de productos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-84095] The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one …

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-84096] The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the …

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-85081] The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File M…

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary J…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-16591] The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category…

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affect…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta de autorización en OpenClaw anterior a 2026.7.1

OpenClaw versiones anteriores a 2026.7.1 presentan un fallo de autorización que permite a usuarios no-propietarios ejecutar cambios de configuración MCP mediante los comandos /mcp set y /mcp unset. Los atacantes pueden persistir comandos MCP arbitrarios en stdio que se ejecutan con los privilegios del proceso OpenClaw, comprometiendo la confidencialidad, integridad y disponibilidad del host. Este riesgo afecta principalmente a empresas en LATAM que utilizan OpenClaw en entornos de producción sin restricciones de acceso adecuadas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad de race condition en paquete npm OpenClaw anterior a 2026.7.1

El paquete OpenClaw (npm) antes de la versión 2026.7.1 contiene una vulnerabilidad de time-of-check time-of-use (TOCTOU) en operaciones del sistema de archivos de OpenShell. Los atacantes pueden explotar condiciones de carrera en operaciones de eliminación, creación y renombre de directorios para eludir controles de sandbox y acceder a rutas no autorizadas. Esta vulnerabilidad afecta a aplicaciones Node.js que dependen de OpenClaw para aislar operaciones del sistema de archivos.

nvdaltovulnerabilidad CVSS 7.8 NVD