Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

Buscando: "Joomla" — 77 resultados ✕ Limpiar búsqueda

13,509

Total alertas

3066

Críticas

10171

Altas

8

Ransomware

1785

Esta semana

RSS

Alta × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-60025] Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens…

Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.

P Alto vulnerabilidad

[CVE-2026-57828] Joomla Extension - phoca.cz - Authenticated file upload in RSFiles component < 6.1.3 - The Joomla ex…

Joomla Extension - phoca.cz - Authenticated file upload in RSFiles component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

A Alto vulnerabilidad

[CVE-2026-56292] Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnera…

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.

J Alto vulnerabilidad

[CVE-2026-48957] An improper access check allows unauthorized users to access com_privacy datasets.

An improper access check allows unauthorized users to access com_privacy datasets.

J Alto vulnerabilidad

[CVE-2026-48958] An improper access check allows unauthorized users to create custom fields via webservices endpoints…

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

J Alto vulnerabilidad

[CVE-2026-48948] An improper access check allows user to download vcard exports of com_contact contacts that are inac…

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

J Alto vulnerabilidad

[CVE-2026-56290] Vulnerabilidad explotada activamente en Joomlack Page Builder

CISA confirma explotación activa de una vulnerabilidad en Joomlack Page Builder. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-10.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

O Alto vulnerabilidad

[CVE-2026-49049] The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to …

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters.

M Alto vulnerabilidad

[CVE-2023-54357] Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unau…

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses …

M Alto vulnerabilidad

[CVE-2019-25761] Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated at…

Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id parameter. Attackers can send GET requests to index.php with option=com_joomcrm&view=contacts and inject SQL code in the deal_id parameter to extract sensitive database information including table names and sche…

M Alto vulnerabilidad

[CVE-2019-25762] Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows u…

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.

M Alto vulnerabilidad

[CVE-2019-25755] Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated …

Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cmId parameter. Attackers can send POST requests to the editReview task endpoint with URL-encoded SQL UNION statements in the cmId parameter to extract database information including usernames, passwords, and database…

M Alto vulnerabilidad

[CVE-2019-25756] Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated…

Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.

M Alto vulnerabilidad

[CVE-2019-25757] Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers t…

Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vproductid and userid parameters. Attackers can send POST requests to the component with crafted SQL payloads in these parameters to extract sensitive database information including version and database names.

M Alto vulnerabilidad

[CVE-2019-25758] Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authent…

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2019-25759] Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated atta…

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database nam…

M Alto vulnerabilidad

[CVE-2019-25750] Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allow…

Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column …

M Alto vulnerabilidad

[CVE-2019-25751] Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unau…

Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the categorySearch, adType, and citySearch parameters to the displayads component to extract sensitive database information including usernames, da…

M Alto vulnerabilidad

[CVE-2019-25752] Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unau…

Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=com_jbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to e…

M Alto vulnerabilidad

[CVE-2019-25753] Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated att…

Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.

← Anterior 1 2 3 4 Siguiente →