Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57805] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57790] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57791] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57792] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57793] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57794] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57795] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57796] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57798] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shortcodes: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57788] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57789] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57743] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15537] A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerabili…

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15514] A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affec…

A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp of the component PHPRPC Remote Call Interface. Executing a manipulation of the argument phprpc_args can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be use…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15498] A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa…

A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users.php of the component Login. Such manipulation of the argument Login leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no vers…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15490] A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce…

A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk/kd_cs results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product impleme…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15488] A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileCon…

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.4 is able to address this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15489] A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3a…

A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15482] A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown proces…

A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consultar of the component HTTP Handler. Executing a manipulation of the argument nome/perfil/status can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-3576] The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forge…

The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that inclu…

nvdaltovulnerabilidad CVSS 7.2 NVD