Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

Buscando: "Aten" — 81 resultados ✕ Limpiar búsqueda

13,539

Total alertas

3075

Críticas

10192

Altas

8

Ransomware

1764

Esta semana

RSS

Alta × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-73234] FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileI…

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components, absolute paths, or parent traversal. A crafted .FCStd archive with a matching FileIncluded XML attribut…

M Alto vulnerabilidad

[CVE-2016-20097] Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet…

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers can control the markPath value returned by the query to supply an attacker-controlled filesystem path…

M Alto vulnerabilidad

Inyección SQL alta en Koha permite lectura de bases de datos a usuarios autenticados

Koha versiones 24.11.17, 25.05.12, 25.11.06 y 26.05.01 contiene una vulnerabilidad de inyección SQL en el módulo de adquisiciones (acqui/parcels.pl) que permite a personal autenticado con permisos de recepción de órdenes leer contenido arbitrario de la base de datos manipulando el parámetro 'orderby'. Esta exposición afecta directamente a bibliotecas, instituciones educativas y organismos públicos en LATAM que gestionan inventarios bibliográficos mediante Koha.

M Alto vulnerabilidad

Inyección SQL alta en Pimcore admin-ui-classic-bundle afecta gestión de contenidos

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-72562) en Pimcore admin-ui-classic-bundle versión 2.3 y anteriores que permite a usuarios autenticados ejecutar comandos SQL arbitrarios a través del filtro de columna ID en la grilla DataObject. Un atacante con acceso al backend puede exfiltrar, modificar o eliminar bases de datos completas sin validación paramétrica. Esto afecta especialmente a medianas y grandes empresas en LATAM que utilizan Pimcore para gestión de activos digitales y catálogos de productos.

M Alto vulnerabilidad

[CVE-2026-72558] An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the…

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

M Alto vulnerabilidad

Vulnerabilidad alta de autenticación en Task Management System 1.0 de code-projects

Se detectó una vulnerabilidad de autenticación deficiente en el componente Login del archivo /index.php en Task Management System 1.0 de code-projects, permitiendo manipulación del parámetro Password para eludir la autenticación de forma remota. El exploit está públicamente disponible y afecta potencialmente a sistemas de gestión de tareas desplegados en infraestructuras empresariales de LATAM. Con CVSS 7.3, requiere atención inmediata en organizaciones que utilicen esta plataforma.

M Alto vulnerabilidad

Vulnerabilidad alta de traversal de directorios en LOLLMS 2.1.0 permite acceso no autorizado

LOLLMS versión 2.1.0 contiene una vulnerabilidad de traversal de rutas en su módulo de interfaz (SPA catch-all route) que permite a atacantes eludir controles de seguridad mediante secuencias codificadas en URL (%2e%2e) y acceder a archivos fuera del directorio permitido. Este fallo afecta directamente a servidores de IA/ML en empresas LATAM que despliegan esta solución sin actualizar. La vulnerabilidad tiene puntuación CVSS 7.5 (Alta) y requiere atención inmediata en entornos de producción.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-63725] sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around …

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() a…

M Alto vulnerabilidad

[CVE-2026-71288] Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for…

Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: `my @order_by = $input->multi_param('order_by'); foreach my $order (@order_by) { my $value = $input->param($order . "_ovalue"); $query_orderby = " …

M Alto vulnerabilidad

[CVE-2026-16022] @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functiona…

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI…

M Alto vulnerabilidad

Inyección de comandos alta en paquete npm backmeup (CVE-2026-71243)

El paquete backmeup para npm contiene una vulnerabilidad de inyección de comandos (CVSS 8.8) por concatenación insegura de strings en comandos shell. Un atacante puede ejecutar comandos arbitrarios localmente o vía SSH si la aplicación procesa entradas no validadas. Afecta a sistemas de respaldo automatizados y herramientas DevOps en empresas LATAM.

M Alto vulnerabilidad

Vulnerabilidad de inyección SQL en Mautic afecta gestión de contactos

Mautic presenta una vulnerabilidad alta (CVSS 7.1) en el controlador AjaxController donde el parámetro 'field' no se valida correctamente antes de ser usado como identificador SQL directo. Un atacante autenticado podría ejecutar consultas SQL arbitrarias para acceder, modificar o exfiltrar datos de contactos (leads) en sistemas que usan esta plataforma de marketing automation, común en empresas medianas y agencias de LATAM.

M Alto vulnerabilidad

[CVE-2026-7693] The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up t…

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_resto…

M Alto vulnerabilidad

[CVE-2026-69185] Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.…

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

M Alto vulnerabilidad

[CVE-2026-41453] Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allo…

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and bo…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-5057] ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability a…

ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RpcProvider class. The issue results from the lack of authentication prior to allowing access to…

M Alto vulnerabilidad

[CVE-2026-67185] TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers …

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through th…

M Alto vulnerabilidad

[CVE-2026-10207] The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up t…

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper es…

M Alto vulnerabilidad

[CVE-2026-65711] sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authentica…

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or e…

D Alto vulnerabilidad

[CVE-2026-16800] Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions Pow…

Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.

← Anterior 1 2 3 4 5 Siguiente →