Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1023
Esta semana
RSS
Alta × cwe-434 × Limpiar todo ×
M Alto vulnerabilidad
28/08/2026
[CVE-2026-18983] The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site S…
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-77018] The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s…
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/08/2026
[CVE-2026-80237] EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authent…
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/08/2026
[CVE-2026-80233] CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File U…
CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
25/08/2026
[CVE-2026-75496] Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before m…
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
25/08/2026
[CVE-2026-16601] The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vu…
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
25/08/2026
[CVE-2026-56702] Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUp…
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
24/08/2026
[CVE-2026-78245] A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_upl…
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-78202] A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting…
A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-14946] A high privileged remote attacker can upload a .php file and then request it directly from /uploads/…
A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-15049] The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a …
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-68899] Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation…
Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=tr…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
17/08/2026
[CVE-2026-65640] WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file uploa…
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/08/2026
[CVE-2026-16137] In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credential…
In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
17/08/2026
[CVE-2026-74845] Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulner…
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
16/08/2026
Ejecución remota de código en plugin Query Wrangler para WordPress (CVE-2026-14498)
El plugin Query Wrangler para WordPress en versiones hasta 1.5.57 permite ejecución remota de código (RCE) a través del parámetro 'options' en el manejador wp_ajax_qw_form_ajax. La vulnerabilidad existe por falta de verificación de capacidades, ausencia de validación de nonce y sanitización deficiente que permite a atacantes reemplazar opciones de consulta y ejecutar funciones arbitrarias. Afecta alta­mente a sitios WordPress en LATAM que utilizan este plugin sin actualizar, poniendo en riesgo datos empresariales y continuidad operativa.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/08/2026
Ejecución remota de código en plugin Templately para WordPress (CVE-2026-18438)
El plugin Templately para WordPress (versiones hasta 3.7.1) es vulnerable a ejecución remota de código a través de la función fetch_remote_file, que valida incorrectamente el tipo de archivo permitiendo inyección de código malicioso. Sitios web en México y LATAM que usan este plugin de plantillas de Elementor/Gutenberg están expuestos a compromisos totales del servidor.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/08/2026
Vulnerabilidad alta de carga arbitraria de archivos en plugin MaxUpload para WordPress
El plugin MaxUpload para WordPress (versiones hasta 1.4.0) contiene una vulnerabilidad de carga arbitraria de archivos (CVSS 8.8) en la función handle_upload. Un atacante puede eludir validaciones de extensión y MIME en el archivo final ensamblado, permitiendo la ejecución de código malicioso en servidores WordPress. Afecta principalmente a sitios en LATAM que usan este plugin para gestionar cargas de archivos grandes sin aplicar validaciones adicionales.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/08/2026
[CVE-2026-66271] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
14/08/2026
[CVE-2026-66270] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
nvdaltovulnerabilidad CVSS 7.2 NVD