Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/07/2026

[CVE-2026-27060] Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.

Contributor PHP Object Injection in ARMember Premium

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-14249] The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and incl…

The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-8857] A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program fi…

A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58036] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13706] Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability i…

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13707] Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated wit…

Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-12923] The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to…

The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PH…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-57995] phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermis…

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58376] Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows…

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-41896] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default — meaning newly created applications have a null webhook secret. PHP's hash_hmac() function silently …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-56124] phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allow…

phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hash…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-40521] FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handl…

FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PH…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13568] A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability…

A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13565] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affect…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_class1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13566] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by …

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /preview3.php. The manipulation of the argument course_year_section leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13559] A weakness has been identified in code-projects Real State Services 1.0. Impacted is an unknown func…

A weakness has been identified in code-projects Real State Services 1.0. Impacted is an unknown function of the file /single-list_sale.php?action=add. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13553] A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown fun…

A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/mod_amenities/controller.php?action=add. Executing a manipulation of the argument image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13555] A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue…

A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/mod_users/controller.php?action=add. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13552] A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unk…

A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/mod_amenities/controller.php?action=edit. Performing a manipulation of the argument amen_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13550] A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impact…

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD