Alertas de Seguridad de la Información

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-42718] Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

Unauthenticated PHP Object Injection in Booster for WooCommerce

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-12626] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104899] The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre…

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. Thi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104752] The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file up…

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/10/2026

[CVE-2026-104723] The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable t…

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vuln…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/10/2026

[CVE-2026-94589] The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for Word…

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/10/2026

[CVE-2026-107845] Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor…

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under th…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108113] ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI questio…

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server u…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

09/10/2026

[CVE-2026-108109] PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password res…

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

09/10/2026

[CVE-2026-108107] PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.p…

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108108] PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verifica…

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-108101] HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAtt…

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-104081] KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function wit…

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can u…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-94067] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2026-94062] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/10/2026

[CVE-2025-15700] The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from…

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107376] webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\…

webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, befo…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107362] Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) lar…

Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched respo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107639] ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerabili…

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-105830] league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability…

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.

nvdaltovulnerabilidad CVSS 7.5 NVD