Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/06/2026

[CVE-2025-67448] The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The …

The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize user input in SMS messages before storing and displaying them. An attacker can send an SMS containing a malicious XSS payload, which will be executed in the context of the victim's browser when the message is viewed.

nvdaltovulnerabilidad CVSS 7.1 NVD

R Alto vulnerabilidad

04/06/2026

[CVE-2026-49941] Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called …

Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask. If the argument was not a well-formed IP address, then this would lead to indefinite recursio…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

04/06/2026

[CVE-2026-49942] Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a…

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networ…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

04/06/2026

[CVE-2026-46741] Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and value…

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-5228] Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile …

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-43985] Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.1…

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with `SameSite=Lax`, which still permits top-level cross…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-44393] An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitM…

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is acce…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-43984] Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.1…

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only `logFile` view then reads that log file and embeds it into an HTML response without…

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-38570] bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers…

bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-36176] GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plain…

GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. This allows physically-proximate attackers to extract these active tokens to perform unauthorized operations via monitoring the serial UART interface.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10863] A security issue was fixed in the correlations over-correlation endpoint where the order query param…

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query orderi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-59874] HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is det…

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-46638] Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An …

Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to a Denial of Service (DoS).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25745] WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability th…

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25732] PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers t…

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to extract sensitive database information including usernames, passwords, and version details.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25733] NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that a…

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to trigger code execution when the Find function is invoked.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25735] AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers t…

AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers to overwrite structured exception handling pointers by supplying an excessively long URL string. Attackers can craft a malicious URL, paste it into the Open URL dialog, and trigger SEH-based code execution to run arbitrary commands with user privileges.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25736] LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to …

LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.exe or other arbitrary commands.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25728] Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to e…

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25730] Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to …

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to pages.php with crafted id values using error-based SQL injection techniques to extract database credentials, usernames, and version information.

nvdaltovulnerabilidad CVSS 8.2 NVD