Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16154] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affect…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_room1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-44739] Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, …

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacke…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-16014] A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unkno…

A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62238] OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint cross…

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV response, enabling database data…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2025-45868] LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonSer…

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-12753] The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable t…

The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQ…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-15907] A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of…

A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulne…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

15/07/2026

[CVE-2026-56287] A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/…

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged …

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

15/07/2026

[CVE-2026-57821] A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in…

A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduc…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

15/07/2026

[CVE-2026-35152] A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint)…

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthori…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15804] The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can …

The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the confidentiality, integrity, and availability of database data.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12512] The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied…

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-47992] Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command …

Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploi…

nvdaltovulnerabilidad CVSS 7.2 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45073] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion sco…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47295] Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a…

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47296] Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a…

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15703] A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulner…

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15736] Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: I…

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the applica…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15676] A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted eleme…

A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15675] A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an un…

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD