Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25730] Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to …

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to pages.php with crafted id values using error-based SQL injection techniques to extract database credentials, usernames, and version information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25726] All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated …

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames, databases, and version detail…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10840] A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBi…

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10843] A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator…

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-49771] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-3820] There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attack…

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation. Potential impact includes denial-of-service attacks, arbitrary code execution, or perman…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41010] ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@re…

ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41860] CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token reques…

CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling an attacker to intercept traffic between bosh-monitor and the BOSH director or UAA and steal credentials. Affected versions: - BOSH: all versions prior to v282.1…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41011] PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packa…

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41858] Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem…

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Becaus…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41859] A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentia…

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every dir…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10737] The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a…

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive informatio…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10777] A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b8…

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10771] A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntit…

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The proj…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44609] Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: …

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44682] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-50033] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-42061] Local privilege escalation due to excessive permissions assigned to child processes. The following p…

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36609] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce t…

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36611] Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer w…

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.

nvdaltovulnerabilidad CVSS 7.3 NVD