Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/06/2026

[CVE-2023-33999] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42558] Xibo is an open source digital signage platform with a web content management system and Windows dis…

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerabilit…

nvdaltovulnerabilidad CVSS 7.6 NVD

S Alto vulnerabilidad

10/06/2026

[CVE-2026-20258] In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform ve…

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user. T…

nvdaltovulnerabilidad CVSS 7.1 NVD

K Alto vulnerabilidad

10/06/2026

[CVE-2026-53473] A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent w…

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser session. This cross-site scripting (XSS) vulnerability allows the attacker to compromise the victim's R…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-49069] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-8071] The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize …

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

10/06/2026

[CVE-2026-46518] OpenEMR is a free and open source electronic health records and medical practice management applicat…

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, address) are rendered without output encoding i…

nvdaltovulnerabilidad CVSS 7.7 NVD

V Alto vulnerabilidad

10/06/2026

[CVE-2026-41003] An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code o…

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11799] UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.…

UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-34693] Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflecte…

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control. Exploitation of this…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47631] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47634] Improper neutralization of special elements in output used by a downstream component ('injection') i…

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45644] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Li…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45481] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41098] Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack …

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41031] A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Bui…

A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application. This enables attackers to steal administrative access tokens and session credentials.

nvdaltovulnerabilidad CVSS 8.7 NVD

V Alto vulnerabilidad

09/06/2026

[CVE-2026-41845] Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code…

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-7556] The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requ…

nvdaltovulnerabilidad CVSS 7.2 NVD

V Alto vulnerabilidad

08/06/2026

[CVE-2026-41722] VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A m…

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

nvdaltovulnerabilidad CVSS 8.0 NVD

V Alto vulnerabilidad

08/06/2026

[CVE-2026-41723] VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A m…

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

nvdaltovulnerabilidad CVSS 8.0 NVD