Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/09/2026

[CVE-2026-86553] SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its…

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together wi…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-93959] A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue a…

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-94056] Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers…

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-93990] Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allo…

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-93991] Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArc…

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-93992] Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allow…

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-93993] Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation p…

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-94054] Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bo…

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

19/09/2026

Vulnerabilidad alta de exposición de datos en plugin YS LeadGen para WordPress (CVE-2026-1255)

El plugin YS LeadGen para WordPress en versiones hasta 2.1.4 expone datos sensibles de formularios a usuarios no autenticados a través de la acción AJAX 'ysleadgen_get_captured_data'. Atacantes pueden acceder a información personal (nombres, correos, teléfonos) recopilada en formularios de contacto y generación de leads, afectando sitios web corporativos y de marketing en LATAM. El score CVSS 7.5 indica riesgo alto para empresas que dependen de este plugin.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/09/2026

Vulnerabilidad alta de ejecución de shortcodes en ProfilePress para WordPress

El plugin ProfilePress para WordPress (versiones hasta 4.17.2) es vulnerable a ejecución arbitraria de shortcodes por usuarios autenticados debido a validación insuficiente antes de ejecutar do_shortcode. Esta vulnerabilidad afecta sitios de e-commerce, formularios de registro y portales de contenido restringido ampliamente utilizados en LATAM. Un atacante autenticado podría inyectar código malicioso que se ejecute en el contexto del sitio WordPress.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/09/2026

Ejecución Remota de Código en plugin Welcomizer para WordPress (CVE-2026-4327)

El plugin Welcomizer para WordPress en versiones hasta 2.8.1 permite ejecución remota de código sin autenticación. La vulnerabilidad CVSS 8.8 se debe a verificación insuficiente de permisos en el manejador AJAX 'savesection' combinado con uso de eval(). Afecta directamente a sitios WordPress en México y LATAM que ejecuten este plugin sin parchear.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/09/2026

Vulnerabilidad XLS almacenado en plugin Quill Forms para WordPress (CVE-2026-15664)

El plugin Quill Forms versiones hasta 5.7.1 es vulnerable a inyección de scripts maliciosos (XLS) a través del campo 'Other' en formularios de opción múltiple, afectando sitios WordPress sin autenticación requerida. Atacantes pueden ejecutar código JavaScript arbitrario en navegadores de usuarios visitantes, comprometiendo datos sensibles en formularios de encuestas y cuestionarios. Impacta principalmente a sitios de comercio electrónico, educación y servicios financieros en LATAM que utilizan este plugin para recolectar información de clientes.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-86814] The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirm…

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-88824] The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST rout…

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-88926] The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise a…

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-92404] The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST A…

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-76554] The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an im…

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-76790] The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several va…

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-85574] The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check wh…

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-85680] The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user suppli…

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

nvdaltovulnerabilidad CVSS 8.8 NVD