Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/09/2026

[CVE-2026-101860] A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the functio…

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101012] A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6…

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. This manipulation of the argument makeid causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101013] A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec09…

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101005] A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalI…

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrad…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-100909] A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the funct…

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-100901] A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerabili…

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Commit 6ffe823 'better security for public/stream.php' only added CU…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100885] A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the…

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this is…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100875] A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6…

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling relea…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100874] A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3…

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific ve…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-81655] The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its set…

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad alta en AzuraCast anterior a 0.23.8: SSRF y lectura de archivos locales

AzuraCast antes de la versión 0.23.8 contiene vulnerabilidades de Server-Side Request Forgery (SSRF) y lectura de archivos locales en el módulo AutoDJ de obtención de playlists remotas. Un usuario con permisos de Media en la estación puede crear playlists con URLs remotas que apunten a rutas file:// o direcciones internas (loopback/link-local), exponiendo información sensible del servidor. Afecta principalmente a emisoras de radio online y plataformas de streaming en LATAM que utilizan este software para automatizar contenido.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad alta de inyección DQL en AzuraCast anterior a 0.23.8

AzuraCast versiones anteriores a 0.23.8 contiene una vulnerabilidad de inyección DQL en el parámetro sortOrder de la API que permite a atacantes extraer información sensible de bases de datos, incluyendo credenciales de usuario y configuraciones de estaciones de radio. Esta vulnerabilidad afecta principalmente a proveedores de radiodifusión en línea y plataformas de streaming en LATAM que utilizan esta solución.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad de validación de URLs en AzuraCast anterior a 0.23.8 (CVE-2026-100849)

AzuraCast, plataforma de gestión de radio web autohospedada, contiene un fallo en la validación de URLs de webhooks que permite eludir restricciones de acceso a direcciones internas. La función AbstractConnector::getValidUrl() solo rechaza direcciones link-local, permitiendo ataques SSRF contra redes RFC1918 y loopback. Radiodifusoras y proveedores de streaming en LATAM que usen conectores Generic o Discord están expuestos.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100744] A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function…

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.2.0 is sufficient to fix this issue.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100739] A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c…

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for cont…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100713] Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH ke…

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APP…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100697] Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.…

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST contain…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100673] The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render s…

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor wh…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100315] A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c…

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

Inyección SQL alta en CloudClassroom-PHP-Project afecta plataformas educativas

Se ha identificado una vulnerabilidad de inyección SQL en CloudClassroom-PHP-Project (hasta versión 5dadec098bfbbf3300d60c3494db3fb95b66e7be) que permite manipular el parámetro 'eno' en el archivo updatedetailsfromstudent.php. El ataque es remotamente explotable y el exploit ha sido divulgado públicamente. Instituciones educativas y plataformas de aprendizaje en LATAM que usen este software están en riesgo inmediato de comprometimiento de bases de datos estudiantiles.

nvdaltovulnerabilidad CVSS 7.3 NVD