Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14648] A security vulnerability has been detected in code-projects Online Voting System up to 0.x/1.0. This…

A security vulnerability has been detected in code-projects Online Voting System up to 0.x/1.0. This issue affects the function test_input of the file /authentication.php of the component Login. Such manipulation of the argument adminUserName/adminPassword leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14649] A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is the function tes…

A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is the function test_input of the file /saveVote.php. Performing a manipulation of the argument voterName/voterEmail/voterID/selectedCandidate results in sql injection. The attack can be initiated remotely.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14640] A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unkno…

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14641] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by …

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_course.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14642] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by …

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /edit_class2.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-12740] Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter…

Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session ini…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-12746] Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 st…

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting token into the session without verifying that the callback corresponds to an authorization request t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14637] A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd…

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The manipulation of the argument shopping_cart leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed publicly and ma…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14635] A security flaw has been discovered in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c066…

A security flaw has been discovered in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This issue affects some unknown processing of the file application/modules/vendor/controllers/AddProduct.php of the component Vendor Multi-Image Endpoint. Performing a manipulation of the argument folder results in path traversal. It is possible to initiate the attack …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14622] A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d…

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajax_files of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product ado…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71372] Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __r…

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71373] picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allow…

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71375] picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning …

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitrary code when loaded by pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71380] The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host…

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71356] picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.ev…

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71359] picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.gramma…

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71360] picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity fun…

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71362] picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functio…

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71364] picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start fun…

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when loaded.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71366] picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile func…

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbitrary code execution when victims load the files.

nvdaltovulnerabilidad CVSS 8.1 NVD