Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19981] A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launc…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19979] A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19963] A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function sta…

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19962] A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setW…

A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of the argument pppUserName/pptpUserName/L2TPUserName can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respo…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-19960] A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function form…

A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-74792] Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested …

Scriban before 7.0.0 (affected versions

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-74794] Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the Objec…

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-74783] Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails t…

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-73057] stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing att…

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-73060] Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRan…

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-73062] Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multipli…

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

Inyección SQL alta en plugin The Gallery by BestWebSoft para WordPress (versiones ≤4.7.9)

El plugin The Gallery by BestWebSoft para WordPress contiene una vulnerabilidad de inyección SQL (CVE-2026-2497, CVSS 7.2) en el parámetro '_gallery_order_{post_id}' que afecta todas las versiones hasta la 4.7.9. La falta de escape y sanitización de datos POST permite a atacantes ejecutar consultas SQL maliciosas. Esta vulnerabilidad expone datos sensibles en sitios web empresariales y e-commerce en México y Latinoamérica que utilizan este plugin.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad XSS almacenado alta en plugin Infility Global para WordPress (CVE-2026-10734)

El plugin Infility Global para WordPress es vulnerable a Cross-Site Scripting (XSS) almacenado en el endpoint /cf7_record_log en versiones hasta 2.15.21. Atacantes no autenticados pueden inyectar scripts maliciosos que se ejecutan cuando usuarios acceden a páginas comprometidas, comprometiendo datos de formularios de contacto y sesiones de clientes. Afecta a sitios en WordPress que utilizan este complemento para gestionar registros de formularios Contact Form 7.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad XSS almacenado en plugin Bookly para WordPress afecta tiendas en línea

El plugin de reservas Bookly para WordPress (versiones hasta 27.7) permite a atacantes no autenticados inyectar scripts maliciosos mediante la acción AJAX bookly_speed_up_update_addons, aprovechando sanitización insuficiente. Afecta directamente a pequeñas y medianas empresas en LATAM que dependen de WordPress para gestión de citas y reservas. La ejecución del código malicioso ocurre en páginas visitadas por clientes y administradores.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Inyección de código en plugin WCPOS para WooCommerce afecta tiendas en línea

El plugin WCPOS (Point of Sale) para WooCommerce en WordPress contiene una vulnerabilidad alta de inyección de código en el motor de plantillas 'thermal' hasta la versión 1.9.14. Atacantes autenticados pueden ejecutar código PHP arbitrario a través del renderizador de recibos, comprometiendo datos de ventas y clientes en tiendas electrónicas de México y Latinoamérica que utilizan este sistema POS.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Ejecución remota de código en plugin Query Wrangler para WordPress (CVE-2026-14498)

El plugin Query Wrangler para WordPress en versiones hasta 1.5.57 permite ejecución remota de código (RCE) a través del parámetro 'options' en el manejador wp_ajax_qw_form_ajax. La vulnerabilidad existe por falta de verificación de capacidades, ausencia de validación de nonce y sanitización deficiente que permite a atacantes reemplazar opciones de consulta y ejecutar funciones arbitrarias. Afecta alta­mente a sitios WordPress en LATAM que utilizan este plugin sin actualizar, poniendo en riesgo datos empresariales y continuidad operativa.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad de Scripting Almacenado en plugin Platnosci Online Blue Media (Autopay) para WordPress

El plugin Platnosci Online Blue Media (Autopay) para WordPress, versiones hasta 5.0.0, es vulnerable a Cross-Site Scripting (XSS) almacenado a través del parámetro POST 'bm_woocommerce_css_editor_content'. La falla reside en el método Css_Editor::handle_save() que carece de validación de capacidades, verificación de nonce y sanitización de entrada, permitiendo a atacantes inyectar código malicioso sin autenticación. Este vector impacta tiendas de comercio electrónico en LATAM que dependen de WooCommerce para procesar pagos y gestionar inventario.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Inyección SQL alta en Evergreen afecta componente OpenSRF Gateway

Se ha identificado una vulnerabilidad de inyección SQL (CVSS 7.3) en Evergreen versiones hasta 3.14.11, 3.15.11, 3.16.5 y 3.17-beta1. La falla reside en la función desconocida del archivo /osrf-gateway-v1 del servicio open-ils.fielder, permitiendo manipulación remota sin autenticación. Bibliotecas digitales, sistemas de gestión documental y plataformas educativas en LATAM que usan Evergreen están expuestas a exfiltración de datos sensibles.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-19919] A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown funct…

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-19905] A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHS…

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but…

nvdaltovulnerabilidad CVSS 7.3 NVD