Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51923] An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c all…

An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51924] An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the…

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51925] A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a rem…

A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_report.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51926] An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive informati…

An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. A vulnerability was identified in the authentication mechanism that allows user enumeration through the login interface. An attacker can differentiate between valid and invalid usernames based on variations in server responses. This information can be leveraged to ide…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-55207] Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an …

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the vic…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2025-45422] Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal …

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59148] Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-ser…

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-13492] The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and inc…

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to sanitize_text_field() for fields of type 'file', leaving directory-traversal sequences intact) combined with the UsersWP_Forms::upload_file_remove…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2025-63579] Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to b…

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and other sensitive information can be obtained. This affects Kyocera Command Center RX TASKalfa 2552ci, TASKalfa 3252ci, TASKalfa 2553ci, TASKalfa…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-61343] LibreBooking's email template editor save action passes the submitted template name directly into th…

LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59720] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in m…

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59721] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs Gr…

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend cont…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59734] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execut…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-58378] Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker cou…

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51605] A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.…

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51606] An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91)…

An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51603] A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.…

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted second SETUP request. After completing the OPTIONS, DESCRIBE, and a legitimate first SETUP request to obtain a valid session ID, the RTSP service's second-stage URL routing parser fails to validate the length of…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51604] A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.…

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51600] Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP request…

Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a request carrying a Content-Length header is received without a corresponding message body, the RTSP parser enters a persistent body-awaiting state, causing the affected TCP connection to become permanently non-functional. The device does not ac…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51601] Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The d…

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request. An unauthenticated remote attacker who has completed a standard RTSP session handshake can send a PLAY request with an excessively long clock= value to cause the RTSP service to crash.

nvdaltovulnerabilidad CVSS 7.5 NVD