Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72558] An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the…

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72731] Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026…

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19384] A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected…

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/08/2026

[CVE-2026-19355] A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl…

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/08/2026

Inyección SQL alta en node-sql-query afecta aplicaciones Node.js

Se identificó una vulnerabilidad de inyección SQL (CVE-2026-19351) en las versiones 0.1.25 a 0.1.28 de la librería node-sql-query de dresende. La falla reside en el manejador de parámetros de solicitud dentro de las funciones SelectQuery.from y SelectQuery.build (lib/Select.js), permitiendo ataques remotos sin autenticación. El exploit es público y afecta a aplicaciones web y APIs en producción que utilicen esta librería.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/08/2026

Inyección SQL alta en Task Management System 1.0 permite acceso remoto a bases de datos

Se ha identificado una vulnerabilidad de inyección SQL en code-projects Task Management System 1.0 a través del parámetro task_id en el archivo /user/comment_count_user.php. Esta falla permite a atacantes remotos comprometer la integridad y confidencialidad de datos, siendo especialmente alta para empresas en LATAM que gestionan información sensible de proyectos. El exploit ha sido divulgado públicamente, aumentando el riesgo inmediato de explotación.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/08/2026

Inyección SQL alta en Task Management System 1.0 de code-projects

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-19343, CVSS 7.3) en code-projects Task Management System 1.0 a través del archivo /admin/AdminLogin.php. Un atacante remoto puede manipular los parámetros de email/password para ejecutar comandos SQL arbitrarios y comprometer la integridad de bases de datos. El exploit está disponible públicamente, lo que aumenta significativamente el riesgo para empresas mexicanas y latinoamericanas que utilizan este sistema.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19231] A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vu…

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19211] A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown functio…

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

SQL Injection alta en SourceCodester Photo Share Website 1.0

Se identificó una vulnerabilidad de inyección SQL en SourceCodester Photo Share Website 1.0 mediante la manipulación del parámetro email en /social/ajax.php?action=login. El exploit es de acceso público y permite a atacantes remotos comprometer bases de datos de aplicaciones web en empresas mexicanas y latinoamericanas que utilizan esta plataforma. Con CVSS 7.3, representa un riesgo considerable para la confidencialidad e integridad de datos de usuarios.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-15361] The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJA…

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19062] A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. …

A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Ther…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65569] Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.

Subscriber SQL Injection in WP Job Portal

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65547] Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.

Subscriber SQL Injection in Creative Mail

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

06/08/2026

Inyección SQL alta en SourceCodester Computer Repair Shop Management System 1.0

Se detectó una vulnerabilidad de inyección SQL en SourceCodester Computer Repair Shop Management System versión 1.0, específicamente en el archivo /classes/Master.php?f=delete_product mediante manipulación del parámetro ID. El exploit ha sido divulgado públicamente, permitiendo ataques remotos sin autenticación. Afecta principalmente a talleres de reparación y empresas de servicios técnicos en México y LATAM que utilicen este sistema para gestionar inventario de productos.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18970] A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617.…

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclos…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18958] A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79…

A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit is n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71287] Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names usin…

Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace('/[^a-zA-Z0-9_().]/', '', $column)`. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as `SLEEP(5)` passes through completely unmodified. The sanitized value is…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71288] Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for…

Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: `my @order_by = $input->multi_param('order_by'); foreach my $order (@order_by) { my $value = $input->param($order . "_ovalue"); $query_orderby = " …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71292] Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.ad…

Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, whitelists the `dir` (ASC/DESC) request parameter via in_array(), but falls back to the raw, attacker-supplied `sort` GET parameter whenever the requested key is not present in the per-controller $_gridSorting whitelist array: `$column = isset($this->_gridSorting[$params['sort']]) ? ... : $…

nvdaltovulnerabilidad CVSS 7.2 NVD