Alertas de Seguridad de la Información

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-49774] Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station al…

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-52711] Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.

Unauthenticated Broken Access Control in WooCommerce POS

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-52712] Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.

Subscriber SQL Injection in Attendance Manager

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-39437] Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <…

Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2025-68045] Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.

Unauthenticated Broken Access Control in WP Event SOlution

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8444] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' …

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-6933] The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing auth…

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' par…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8443] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 's…

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded arra…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-7273] A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versi…

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48723] The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on Browse…

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-12205] Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key …

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected versio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-12087] Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_s…

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48017] DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reade…

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-11832] Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The defa…

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-9691] Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, …

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52694] Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52695] Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52697] Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Subscriber SQL Injection in Taskbuilder

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52699] Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52700] Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.

Subscriber SQL Injection in WCMultiShipping

nvdaltovulnerabilidad CVSS 8.5 NVD