Alertas de Seguridad de la Información

M Crítico vulnerabilidad

05/08/2026

Inyección SQL crítica en Miantang/IoT-PHP permite autenticación sin credenciales válidas

La aplicación Miantang/IoT-PHP contiene una vulnerabilidad de inyección SQL en la ruta POST /userlogin debido a que no sanitiza el parámetro de contraseña antes de concatenarlo en una consulta SQL raw. Un atacante puede eludir la autenticación ingresando caracteres especiales en el campo de contraseña. Esta vulnerabilidad afecta sistemas IoT y aplicaciones embebidas en infraestructuras críticas de LATAM, permitiendo acceso no autorizado a datos sensibles y control del dispositivo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71231] IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM …

IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71207] The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password v…

The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can submit a payload such as ' OR '1'='1 in the login form to bypass authentication entirely. The same s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18881] The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injec…

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query — the value is split …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-15360] The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter …

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15918] VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injec…

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arb…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18859] A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of th…

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18854] A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. T…

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48326] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48330] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this is…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-69240] Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dia…

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE. In the Oracle dialect, when val is a string and starts with TO_TIMESTAMP or TO_DATE, escape returns val directly instead of replacing single quotes. An attacke…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-41453] Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allo…

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and bo…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-69083] SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetConten…

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-69084] SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-su…

SiYuan versions

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-69085] SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint…

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement exec…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-16572] The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie …

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16532] The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied…

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-16539] The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value be…

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-12965] The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthentica…

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/08/2026

[CVE-2026-65321] PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attacker…

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape char…

nvdcriticovulnerabilidad CVSS 9.8 NVD