Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18859] A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of th…

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18854] A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. T…

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18814] A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of th…

A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18813] A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /a…

A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18811] A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the f…

A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18812] A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of th…

A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18787] A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function r…

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this d…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18770] A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e…

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or update…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69097] GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attacke…

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18600] A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.s…

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18598] A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function …

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this d…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18599] A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread…

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54661] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54662] swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t…

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject T…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54664] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject c…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54666] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execu…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16765] A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unk…

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16484] A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vuln…

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-16252] A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Busi…

A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function of the file /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa. The manipulation of the argument Structure_ID results in sql injection. It is possible to launch the attack remotely. The exploit has been …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16228] A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an…

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD