Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/10/2026

Inyección SQL alta en Zen Cart afecta manejador de pagos PayPal

Se identificó una vulnerabilidad de inyección SQL en Zen Cart versiones hasta 2.2.2 que afecta la función zen_db_perform en el manejador IPN de PayPal (paypaldp.php). Un atacante puede manipular el parámetro txn_id para ejecutar consultas SQL maliciosas de forma remota. El exploit es público y operativo, impactando directamente tiendas de comercio electrónico en LATAM que procesan pagos con PayPal integrado.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

Inyección SQL alta en EmployeeRecruitmentSystem afecta portales de reclutamiento

Se identificó una vulnerabilidad de inyección SQL (CVSS 7.3) en EmployeeRecruitmentSystem que permite manipulación remota del componente Registration Handler mediante el archivo adminregister.php. El exploit está disponible públicamente, poniendo en riesgo sistemas de gestión de personal y bases de datos de candidatos en empresas de LATAM que utilicen esta solución.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108805] A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae35…

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Con…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108806] A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36…

A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108799] A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacte…

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicl…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108963] databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., maria…

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108905] pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool…

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/10/2026

Inyección SQL alta en Xinhu Rainrock RockOA permite ejecución remota de código

Se ha identificado una vulnerabilidad de inyección SQL en Xinhu Rainrock RockOA versiones hasta 2.7.6 en el componente Openkqj Action (archivo openkqjAction.php). Un atacante remoto puede manipular el parámetro ID para ejecutar comandos SQL arbitrarios en la base de datos del sistema. El exploit está disponible públicamente, aumentando el riesgo inmediato para empresas en LATAM que usan esta plataforma de gestión documental.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-62130] Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-62021] Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

Subscriber PHP Object Injection in Angio

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-12626] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104899] The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre…

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. Thi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104752] The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file up…

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104723] The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable t…

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vuln…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108113] ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI questio…

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server u…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108108] PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verifica…

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108101] HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAtt…

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-104081] KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function wit…

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can u…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-94067] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-94062] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.

nvdaltovulnerabilidad CVSS 8.1 NVD