Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1003
Esta semana
RSS
Alta × cwe-89 × Limpiar todo ×
M Alto vulnerabilidad
17/06/2026
[CVE-2026-48967] Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.
Subscriber SQL Injection in Geo Mashup
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-22335] Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.
Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-12360] The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and includin…
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL constructi…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2025-69135] Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-39581] Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-52712] Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.
Subscriber SQL Injection in Attendance Manager
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-8444] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' …
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing …
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
16/06/2026
[CVE-2026-8443] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 's…
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded arra…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-52697] Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.
Subscriber SQL Injection in Taskbuilder
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-52700] Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.
Subscriber SQL Injection in WCMultiShipping
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-48964] Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.
Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-48882] Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.
Subscriber SQL Injection in WP Time Slots Booking Form
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-48874] Subscriber SQL Injection in GamiPress <= 7.8.7 versions.
Subscriber SQL Injection in GamiPress
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-40762] Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-40766] Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.
Subscriber SQL Injection in MasterStudy LMS
nvdaltovulnerabilidad CVSS 8.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
15/06/2026
[CVE-2026-24637] Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.
Contributor SQL Injection in PowerPress Podcasting
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-36670] A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Pa…
A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2019-25746] WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows au…
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20071] The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injecti…
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20072] BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unaut…
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user inf…
nvdaltovulnerabilidad CVSS 8.2 NVD