Alertas de Seguridad de la Información

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-62090] Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

Unauthenticated PHP Object Injection in WineShop

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-62050] Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

Unauthenticated PHP Object Injection in Splendour

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-62051] Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

Unauthenticated PHP Object Injection in Stargaze

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-62052] Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

Unauthenticated PHP Object Injection in Tipsy

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-62053] Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

Unauthenticated PHP Object Injection in Wine House

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-62054] Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

Unauthenticated PHP Object Injection in Yacht Rental

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-42719] Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

Subscriber PHP Object Injection in Dynamic User Directory

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-42723] Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

Unauthenticated PHP Object Injection in CleanSkin

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-42716] Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-42718] Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

Unauthenticated PHP Object Injection in Booster for WooCommerce

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-94589] The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for Word…

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/10/2026

[CVE-2026-107845] Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor…

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under th…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

09/10/2026

[CVE-2026-108109] PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password res…

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

09/10/2026

[CVE-2026-108107] PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.p…

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/10/2026

[CVE-2026-103692] The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce che…

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/10/2026

[CVE-2026-104070] The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows …

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a m…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/10/2026

[CVE-2026-39797] Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

Unauthenticated PHP Object Injection in GDPR Framework By Data443

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-56660] GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of…

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to b…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-103475] yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting …

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-100512] Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.

Contributor PHP Object Injection in Nested Pages

nvdcriticovulnerabilidad CVSS 9.8 NVD