Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1017
Esta semana
RSS
Crítica × cwe-89 × Limpiar todo ×
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-48330] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this is…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-69240] Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dia…
Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacke…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-69083] SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetConten…
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-69084] SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-su…
SiYuan versions
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-69085] SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint…
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement exec…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-16532] The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied…
The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-12965] The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthentica…
The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
02/08/2026
[CVE-2026-65321] PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attacker…
PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape char…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
31/07/2026
[CVE-2026-17351] The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assist…
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's defau…
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
31/07/2026
[CVE-2026-63221] CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()…
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed i…
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69933] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69934] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69935] CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and reven…
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69936] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69937] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpo…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69938] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the param…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69941] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=…
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69947] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69930] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-65336] Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price…
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
nvdcriticovulnerabilidad CVSS 9.8 NVD