Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/07/2026

[CVE-2026-63429] HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authe…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoi…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-48062] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in …

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-36669] An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.…

An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/ directory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-13352] The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C…

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61457] The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass i…

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions bl…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48356] Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that …

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15677] A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown funct…

A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeekerInsert.php. Executing a manipulation of the argument txtFile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-58409] ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated admin…

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php fi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-49972] Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attac…

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any file…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57710] Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbo…

Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57719] Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-…

Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15488] A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileCon…

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.4 is able to address this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD

P Alto vulnerabilidad

11/07/2026

[CVE-2026-57828] Joomla Extension - phoca.cz - Authenticated file upload in RSFiles component < 6.1.3 - The Joomla ex…

Joomla Extension - phoca.cz - Authenticated file upload in RSFiles component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

nvdaltovulnerabilidad CVSS 8.8 NVD

R Crítico vulnerabilidad

11/07/2026

[CVE-2026-57827] Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The J…

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-2354] The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed…

The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()` function hooks into WordPress's `wp_check_filetype_and_ext` filter and uses `strpos()` to check if a filename contains a configured extension string, ra…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15282] The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing …

The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-13430] The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all…

The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.13.1 via the import_media_file_secure function. This is due to insufficient file extension validation caused by a trailing-dot filename bypass, where the extension allow-list check in ajax_import_media_start() uses pathinfo() on the raw ZIP entry name (e.g., 'shell.…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-14894] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Uplo…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-15158] The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up…

The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that approves any filename containing .woff2 or .ttf as a substring via strpos() rather than validating that those strings appear as the final extens…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-58480] Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file …

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension file…

nvdcriticovulnerabilidad CVSS 9.8 NVD