Alertas de Seguridad de la Información

M Crítico vulnerabilidad

29/06/2026

[CVE-2026-37637] An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the fi…

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-56057] Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

Subscriber PHP Object Injection in Uncanny Automator Pro

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-56032] Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

Subscriber PHP Object Injection in Buddyboss Platform

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Crítico vulnerabilidad

25/06/2026

[CVE-2026-40079] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vu…

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandl…

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Crítico vulnerabilidad

24/06/2026

[CVE-2026-39948] Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, th…

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses in lib/html_graph.php and lib/html_tree.php, which are reachable pre-authentication through graph_view.php on installatio…

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Crítico vulnerabilidad

24/06/2026

[CVE-2026-39955] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have p…

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php. This issue has been fixed in version 1.2.31.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2022-50972] WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute ar…

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2019-25763] WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability…

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and a…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/06/2026

[CVE-2026-7515] The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and…

The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/06/2026

[CVE-2026-54414] FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/fo…

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename() and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %). The raw filename is then passed to Up…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-55742] Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the ad…

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visitin…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-55740] Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad)…

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=$busid) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context. A remote…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-49108] Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2025-69127] Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

Unauthenticated PHP Object Injection in Plumbing

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2025-69111] Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Reisen

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54806] Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

Unauthenticated PHP Object Injection in WP Activity Log

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54194] Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Contributor PHP Object Injection in Fusion Builder

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-52706] Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

Unauthenticated PHP Object Injection in JetEngine

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-49107] Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-49075] Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

Contributor PHP Object Injection in JetEngine

nvdcriticovulnerabilidad CVSS 9.8 NVD