Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Php" — 1109 resultados ✕ Limpiar búsqueda
26,377
Total alertas
5296
Críticas
20202
Altas
8
Ransomware
1735
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
19/08/2026
Inyección SQL alta en SourceCodester Simple Online Food Ordering System 1.0
Se identificó una vulnerabilidad de inyección SQL en el módulo de administración (/admin/ajax.php?action=delete_menu) del sistema de pedidos en línea SourceCodester versión 1.0. Un atacante remoto puede manipular el parámetro ID para ejecutar comandos SQL arbitrarios, comprometiendo la integridad y confidencialidad de bases de datos de restaurantes y datos de clientes. El exploit está públicamente disponible y afecta directamente a plataformas de delivery y comercio electrónico en LATAM.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
19/08/2026
Inyección SQL alta en SourceCodester Simple Online Food Ordering System 1.0
Se ha identificado una vulnerabilidad de inyección SQL en el módulo de administración (/admin/ajax.php?action=save_menu) del sistema SourceCodester Simple Online Food Ordering System versión 1.0, permitiendo a atacantes remotos manipular consultas a base de datos mediante el parámetro ID. Esta afecta directamente a restaurantes y negocios de alimentos en LATAM que utilizan esta plataforma para gestionar menús y pedidos online. El exploit está disponible públicamente, elevando significativamente el riesgo de compromisos inmediatos.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
19/08/2026
Inyección SQL alta en SourceCodester Simple Online Food Ordering System 1.0
Se ha identificado una vulnerabilidad de inyección SQL en SourceCodester Simple Online Food Ordering System 1.0 a través del parámetro Username en /admin/ajax.php?action=login. Un atacante remoto puede ejecutar comandos SQL maliciosos sin autenticación válida, comprometiendo bases de datos de órdenes, clientes y pagos. Esta vulnerabilidad afecta directamente a restaurantes, fondas y servicios de delivery en LATAM que utilicen este sistema de código abierto.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-75986] A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element i…
A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-54347] Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accept…
Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer …
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-54348] Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.upd…
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel_admins.ip without enforcing numeric element types. When the poisoned account later calls IpsAndPorts.listing, lib/Froxlor/Api/Commands/IpsAndPorts.php decodes the array an…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-52793] Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path i…
Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentica…
nvdaltovulnerabilidad CVSS 8.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
18/08/2026
[CVE-2026-49225] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql …
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-49228] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mu…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-49224] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id,…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-49221] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.s…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-49226] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplic…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-49227] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-74012] Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.
Editor PHP Object Injection in TaxoPress
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-66620] Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
Editor PHP Object Injection in OptionTree
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
18/08/2026
[CVE-2026-32465] Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
Customer PHP Object Injection in Essential Real Estate
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-75778] A vulnerability was identified in code-projects Task Management System 1.0. This affects the functio…
A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-75827] Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare…
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-75089] A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue…
A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check_availability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-75079] A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnera…
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_subject2.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
nvdaltovulnerabilidad CVSS 7.3 NVD