Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65450] Contributor SQL Injection in MapSVG <= 8.14.0 versions.

Contributor SQL Injection in MapSVG

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65451] Contributor SQL Injection in MapSVG <= 8.14.0 versions.

Contributor SQL Injection in MapSVG

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65454] Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

Contributor SQL Injection in Quiz And Survey Master

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-25405] Contributor SQL Injection in eRoom <= 1.7.1 versions.

Contributor SQL Injection in eRoom

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-24552] Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.

Contributor SQL Injection in Create by Mediavine

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-9713] The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via …

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-12987] The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data o…

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unau…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62516] Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Pr…

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in takeover of Oracle Demantra …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-60582] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized creation, de…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16484] A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vuln…

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-52476] SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive informa…

SQL Injection vulnerability in aiflowy

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-64880] Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL que…

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-55084] DHIS2 is a flexible information system for data capture, management, validation, analytics and visua…

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-8082] The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter bef…

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-47255] AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to versio…

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed ou…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-16252] A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Busi…

A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function of the file /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa. The manipulation of the argument Structure_ID results in sql injection. It is possible to launch the attack remotely. The exploit has been …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-11349] The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress …

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16228] A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an…

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16227] A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. …

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16152] A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an un…

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD