Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11484] A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts…

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipulation of the argument sy causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11485] A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. …

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive2.php. Such manipulation of the argument sy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11486] A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by th…

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /archive1.php. Performing a manipulation of the argument sy results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11482] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted…

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /archive5.php. The manipulation of the argument sy leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2023-54350] WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder co…

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2023-54351] WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows u…

WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11474] A security flaw has been discovered in Kushan2k student-management-system up to f16a4ceaddd6729c4b30…

A security flaw has been discovered in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected is an unknown function of the file service/RegisterService.php of the component Registration Endpoint. Performing a manipulation of the argument stimg results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11471] A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted elem…

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The manipulation of the argument Password results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11472] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /index1.php. This manipulation of the argument Password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11462] A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This imp…

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. This impacts the function callback of the file plugins/Stripe/Controllers/StripeController.php of the component Stripe Plugin. Performing a manipulation of the argument Request results in improper authorization. The attack can be initiated remotely. The exploit has been made public and could be used. The pa…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11456] A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/j…

A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxf_dump_systable.php of the component HTTP GET Request Handler. Such manipulation of the argument gblOrgID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-9290] The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local …

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass acc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-7654] The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code …

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for au…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-46493] HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `u…

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-46392] HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX …

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the `.htaccess` rule that forces `Content-Disposition: attachment` on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (`.HTML`, `.Html`, `.HTM…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11342] A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affec…

A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11344] A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown fu…

A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11334] A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec8…

A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This affects an unknown function of the file dashboard_page/forms/fetch.php. Performing a manipulation of the argument department_code results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Conti…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-10877] A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up…

A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up to 1.0. This impacts an unknown function of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25732] PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers t…

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to extract sensitive database information including usernames, passwords, and version details.

nvdaltovulnerabilidad CVSS 8.2 NVD