Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105387] A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757…

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105384] A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d1…

A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105385] A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473…

A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transaction_details.php. Executing a manipulation of the argument transaction_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utiliz…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-104905] FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::…

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specifie…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105382] A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699d…

A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument user_id causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105383] A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473…

A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling relea…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-104890] Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7…

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/10/2026

Vulnerabilidad alta de SSRF en feelec-yishu feelcrm-os 1.0.0

Se identificó una vulnerabilidad de Server-Side Request Forgery (SSRF) en feelcrm-os versión 1.0.0 que permite manipular el parámetro URL en el endpoint getCurlData del controlador GoogleController.class.php. Un atacante remoto puede ejecutar solicitudes no autorizadas desde el servidor afectado hacia sistemas internos o externos, comprometiendo la confidencialidad de datos y la integridad de la infraestructura. El exploit ha sido divulgado públicamente, elevando significativamente el riesgo para empresas mexicanas y latinoamericanas que utilicen este CRM.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

SQL Injection alta en itsourcecode Online Admission System 1.0 expone datos de admisiones

Se identificó una vulnerabilidad de inyección SQL en el archivo /admin/login1.php del sistema de admisiones en línea itsourcecode versión 1.0, permitiendo a atacantes remotos manipular el parámetro User para acceder no autorizado a bases de datos. Esta falla afecta directamente a instituciones educativas en LATAM que utilizan esta solución para gestionar procesos de admisión de estudiantes. El exploit ha sido públicamente divulgado, elevando significativamente el riesgo de explotación inmediata.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

Inyección SQL alta en SourceCodester Online Reviewer Management System 1.0

Se identificó una vulnerabilidad de inyección SQL en SourceCodester Online Reviewer Management System versión 1.0, específicamente en el parámetro 'Subject' del archivo btn_functions.php. La vulnerabilidad permite a atacantes remotos ejecutar comandos SQL maliciosos sin autenticación, comprometiendo bases de datos de instituciones educativas y empresas que utilicen este sistema. El exploit ha sido divulgado públicamente, aumentando el riesgo inmediato de explotación.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

Inyección SQL alta en SourceCodester Online Reviewer Management System 1.0

Se identificó una vulnerabilidad de inyección SQL en SourceCodester Online Reviewer Management System versión 1.0, específicamente en el parámetro Subject del archivo btn_functions.php?action=update. La vulnerabilidad permite a atacantes remotos manipular consultas SQL y comprometer la integridad de bases de datos. El exploit está públicamente disponible y afecta principalmente a instituciones educativas y plataformas de evaluación académica en LATAM.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105231] A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72…

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument email/username/location results in sql injection. It is possible to launch the attack remotely. The exp…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

Inyección SQL alta en sistema de gestión de residuos food-waste-management-system

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-105232, CVSS 7.3) en el archivo deliverysignup.php del componente de página de registro del sistema food-waste-management-system. Un atacante remoto puede manipular los parámetros username, email o location para ejecutar comandos SQL arbitrarios. Esta vulnerabilidad afecta sistemas de gestión de residuos implementados en restaurantes, cadenas de comida rápida y empresas de distribución en LATAM que utilicen esta plataforma.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105230] A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb8289…

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Impacted is an unknown function of the file delivery/deliverymyord.php. The manipulation of the argument delivery_person_id/order_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclo…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105229] A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f…

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This issue affects some unknown processing of the file signup.php of the component User Registration Endpoint. Executing a manipulation of the argument email/name/gender can lead to sql injection. The attack may be performed from remote. The ex…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105185] A vulnerability was detected in itsourcecode Online Admission System 1.0. This affects an unknown fu…

A vulnerability was detected in itsourcecode Online Admission System 1.0. This affects an unknown function of the file /admin/examinee.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105182] A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacte…

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=update. The manipulation of the argument Title results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105183] A weakness has been identified in itsourcecode Online Admission System 1.0. The affected element is …

A weakness has been identified in itsourcecode Online Admission System 1.0. The affected element is an unknown function of the file /admin/confirm.php. This manipulation of the argument schedid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105184] A security vulnerability has been detected in itsourcecode Online Admission System 1.0. The impacted…

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. The impacted element is an unknown function of the file /admin/creteria.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105175] A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some …

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /Auth/add_student.php of the component Student Registration. The manipulation of the argument cmdschool results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD