Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/07/2026

[CVE-2026-49972] Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attac…

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any file…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-49969] Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remot…

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdap…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-49970] Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() fu…

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim(…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-26396] OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XA…

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2025-45869] LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (…

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61462] mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that al…

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61463] Shiori contains a privilege escalation vulnerability in the account update endpoint that allows auth…

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15584] A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool …

A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-59521] Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-fr…

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61955] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61956] Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسل…

Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام – همگام سازی ووکامرس و باسلام: from n/a through

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57814] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57815] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57816] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-59516] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57799] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57800] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57801] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57802] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur struktur allows PHP Local File Inclusion.This issue affects Struktur: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57803] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core struktur-core allows PHP Local File Inclusion.This issue affects Struktur Core: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD