Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,509
Total alertas
3066
Críticas
10171
Altas
8
Ransomware
1810
Esta semana
RSS
Alta × cwe-89 × Limpiar todo ×
M Alto vulnerabilidad
25/06/2026
[CVE-2026-37149] GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL …
GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-54829] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-54838] Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.
Subscriber SQL Injection in WC Vendors Marketplace
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-54822] Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.
Subscriber SQL Injection in SALESmanago & Leadoo
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-12937] The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for Word…
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appe…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-12077] The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' …
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin…
nvdaltovulnerabilidad CVSS 7.5 NVD
Q Alto vulnerabilidad
25/06/2026
[CVE-2026-9781] Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerab…
Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURASDevice JSON-…
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
Q Alto vulnerabilidad
25/06/2026
[CVE-2026-9782] Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulner…
Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDeviceDrive J…
nvdaltovulnerabilidad CVSS 8.8 NVD
Q Alto vulnerabilidad
25/06/2026
[CVE-2026-9783] Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vul…
Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURemovableM…
nvdaltovulnerabilidad CVSS 8.8 NVD
Q Alto vulnerabilidad
25/06/2026
[CVE-2026-9784] Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulner…
Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibraryPort J…
nvdaltovulnerabilidad CVSS 8.8 NVD
Q Alto vulnerabilidad
25/06/2026
[CVE-2026-9785] Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulner…
Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibrarySlot J…
nvdaltovulnerabilidad CVSS 8.8 NVD
Q Alto vulnerabilidad
25/06/2026
[CVE-2026-9786] Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab…
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-…
nvdaltovulnerabilidad CVSS 8.8 NVD
C Alto vulnerabilidad
25/06/2026
[CVE-2026-39951] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a…
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31.
nvdaltovulnerabilidad CVSS 7.6 NVD
Q Alto vulnerabilidad
25/06/2026
[CVE-2026-7570] Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab…
Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-…
nvdaltovulnerabilidad CVSS 8.8 NVD
N Alto vulnerabilidad
24/06/2026
[CVE-2026-56351] n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft …
n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integr…
nvdaltovulnerabilidad CVSS 8.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
24/06/2026
[CVE-2026-56052] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-9179] The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter…
The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() functi…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-8705] The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` …
The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so executi…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
23/06/2026
[CVE-2025-61024] An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers …
An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
23/06/2026
[CVE-2025-61029] An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cau…
An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
nvdaltovulnerabilidad CVSS 7.5 NVD