Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Php" — 1098 resultados ✕ Limpiar búsqueda
26,305
Total alertas
5286
Críticas
20147
Altas
8
Ransomware
1745
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39532] Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
Contributor PHP Object Injection in Events Calendar for GeoDirectory
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39498] Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
Shop manager PHP Object Injection in YayMail
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39499] Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6…
Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39474] Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.
Contributor PHP Object Injection in Post Duplicator
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39478] Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versio…
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39481] Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
Author PHP Object Injection in Modula Image Gallery
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39471] Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.
Author PHP Object Injection in ShortPixel Image Optimizer
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39472] Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39434] Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
Shop manager PHP Object Injection in CTX Feed
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-36670] A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Pa…
A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20084] WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities…
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitra…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2018-25437] WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows …
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2019-25746] WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows au…
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20081] WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows una…
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20073] Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unau…
Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.
nvdaltovulnerabilidad CVSS 8.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20075] WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows…
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arb…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20076] WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attacker…
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive file…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2016-20068] WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injecti…
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id'…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-12204] A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderC…
A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/controller/Crontab.php of the component Scheduled Task Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The v…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
12/06/2026
[CVE-2026-12066] A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the functio…
A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/checkcode results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may …
nvdaltovulnerabilidad CVSS 7.3 NVD