Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54844] Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.

Unauthenticated Broken Access Control in CheckView Automated Testing

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54845] Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

Unauthenticated Local File Inclusion in MDTF

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54829] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54830] Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.

Unauthenticated Broken Access Control in Five Star Restaurant Reservations

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54838] Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

Subscriber SQL Injection in WC Vendors Marketplace

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54821] Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.

Subscriber Sensitive Data Exposure in Visual Link Preview

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54822] Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

Subscriber SQL Injection in SALESmanago & Leadoo

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54828] Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

Unauthenticated Broken Access Control in Motors

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-27366] Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.

Unauthenticated Broken Access Control in MainWP Child

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-33612] A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to …

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisoning.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12937] The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for Word…

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-5305] The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin bef…

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-9702] The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the leg…

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12077] The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' …

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-55759] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from serv…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-55762] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authorization check. Any authenticated user — including a standard user role account — can call this endpoint with {"setDeploymentAs": "new-workspace…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-54066] SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-202…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-54070] SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME i…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitize(true). The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schools legacy handler list. That m…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10043] MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulner…

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. T…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-52805] Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF…

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated user can submit a public URL that redirects to a blocked internal endpoint (e.g., 127.0.0.1), importi…

nvdaltovulnerabilidad CVSS 8.7 NVD