Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
Alta × cwe-89 × Limpiar todo ×
M Alto vulnerabilidad
29/07/2026
[CVE-2025-67407] Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_studen…
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2025-67408] Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.ph…
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-5490] DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attacke…
DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied string befo…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-63231] A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker t…
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-7769] IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 throug…
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in t…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-14785] The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' …
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that ca…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-10207] The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up t…
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper es…
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
28/07/2026
[CVE-2026-13161] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to gene…
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addition…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-14516] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL qu…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-12800] The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Inje…
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method witho…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-12741] The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic…
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queri…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-51077] SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive infor…
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-66427] Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
Administrator SQL Injection in WP Google Review Slider
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59551] Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59537] Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommer…
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
nvdaltovulnerabilidad CVSS 7.6 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
23/07/2026
[CVE-2026-16765] A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unk…
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-65532] Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
Shop manager SQL Injection in Persian Woocommerce SMS
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-65526] Contributor SQL Injection in Visualizer <= 4.0.6 versions.
Contributor SQL Injection in Visualizer
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-65494] Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.
Subscriber SQL Injection in Dokan Pro
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-65462] Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
Administrator SQL Injection in Uncanny Automator
nvdaltovulnerabilidad CVSS 7.6 NVD