Alertas de Seguridad de la Información

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84082] IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands du…

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84064] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary S…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84073] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary S…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-80441] IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vul…

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-61781] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partman_user INSERT and UPDATE privileges can store SQL rather than a function name. When pg_partman_…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2023-54399] Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint…

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payload to read arbitrary database content, including credential tables such as operuser. Exploitation eviden…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-67100] HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure fla…

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-75513] Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9…

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictiona…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-61667] DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0…

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query ca…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2024-58385] Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php…

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-76461] A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could …

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-77051] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-82232] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-86460] Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search condi…

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81800] Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.

Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés)

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-9163] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-7188] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/09/2026

[CVE-2026-67401] A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root thr…

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-75746] ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQ…

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-79569] Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter…

Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

nvdcriticovulnerabilidad CVSS 9.8 NVD