Alertas de Seguridad de la Información

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51537] EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager ha…

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser to continue reading fields even when request data is insufficient. This issue is remotely triggerabl…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51538] EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability i…

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51540] OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue …

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51541] OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling m…

OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and co…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51821] SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacke…

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-58409] ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated admin…

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php fi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-61500] Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Ma…

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full admi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-60121] Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj…

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decod…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-61498] Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj…

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-suppli…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57811] Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic…

Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Remote Code Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57813] Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege …

Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-59515] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-59518] Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injec…

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57770] Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography all…

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57738] Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Inject…

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57739] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57744] Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions a…

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57724] Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This …

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57726] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57710] Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbo…

Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through

nvdcriticovulnerabilidad CVSS 9.9 NVD