Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-104932] The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deser…

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-55872] GYM One is open-source gym management software for fitness centers, personal trainers, and sports cl…

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the ad…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111231] Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-onl…

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-leve…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111229] pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_…

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111220] pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that…

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111215] Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenti…

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0; via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interp…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-104827] react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.…

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-61611] Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has …

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an al…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-53582] OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust modul…

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager o…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-81534] The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Executi…

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with su…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-55681] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with acces…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-55682] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/segu…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-110761] ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authent…

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-54554] FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.…

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Di…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-110646] Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows…

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-104764] The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all …

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-104909] The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and…

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-103367] The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Incl…

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypas…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-86787] The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from sup…

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-63165] Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functi…

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extra…

nvdaltovulnerabilidad CVSS 8.1 NVD