Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/10/2026

[CVE-2026-102379] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad SSRF alta en Budibase 3.41.0 afecta generación de tablas con IA

Budibase versiones hasta 3.41.0 contiene una vulnerabilidad de Server-Side Request Forgery (SSRF) en la función de generación de tablas con IA. Usuarios autenticados pueden explotar la función uploadUrl en fileUtils.ts para enviar solicitudes a URLs internas, obteniendo acceso a recursos sensibles del servidor. El impacto afecta especialmente a empresas en LATAM que usan Budibase en entornos productivos sin aislamiento de red adecuado.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad de omisión de autorización en Obot 0.21.1 a 0.24.1 (CVE-2026-103758)

Obot versiones 0.21.1 hasta 0.24.1 contienen una vulnerabilidad de omisión de controles de autorización que permite a usuarios autenticados con rol básico acceder a servidores MCP mediante la ruta /mcp-connect-composite/, no incluida en la lista de denegación. Usuarios con IDs MCP compuestos pueden enviar solicitudes proxy a través de mcpGateway.Proxy para invocar herramientas en servidores restringidos, evadiendo reglas de control de acceso.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-92144] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whene…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-95687] The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalatio…

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrato…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-96813] The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is v…

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-15983] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Dire…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the `super_save_form` AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create or modify Super Forms and enable the `file_upload_submission_delete` setting — combined with the `s…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-85235] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-14995] The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Pa…

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-19807] The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escal…

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the ca…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-80276] Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a …

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read in cleartext by a remote, unauthenticated attacker.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-19253] The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a …

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to i…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-82826] Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sens…

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-82828] Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unpri…

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-96561] The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to …

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advis…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102143] An unauthenticated attacker could cause a file with attacker-controlled content to be written to the…

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102121] A form-rendering interface in the Advanced Forms component is reachable without authentication so th…

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deploymen…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102123] A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended dire…

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering it unavailable until an operator intervenes. Exploitation requires network access to the affected interf…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102112] A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained c…

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102114] A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administr…

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD