Alertas de Seguridad de la Información

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-85984] The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to A…

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as suffici…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-77203] The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalati…

The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100720] Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowe…

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits s…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100713] Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH ke…

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APP…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100714] Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlik…

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safe_exec. Because safe_exec only bla…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100715] Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP dat…

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because mak…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100716] Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (…

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100717] froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl reje…

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2. An authenticated low-privilege customer with subdomain-create rights (no admin or chan…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100718] Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.ad…

Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100708] Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key con…

Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings queries are passed through ApiCommand::response() without any field stripping or allowlist. A low-privileged authenticated customer API calle…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100709] Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) wit…

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100711] froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust c…

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after password rotation, bypassing incident response actions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100700] nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text f…

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100703] Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment …

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A tenant who can create a namespaced policy (e.g. NamespacedValidatingPolicy, and likewise the namespaced mutating, deleting, generating, and…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100704] Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPol…

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource causes image signature verification to be skipped for the entire resource rather than only for the lis…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100705] Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (16…

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or to the GlobalContextEntry external-API…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100706] kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath…

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyExc…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100707] Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespac…

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100693] Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security…

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100697] Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.…

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST contain…

nvdaltovulnerabilidad CVSS 8.6 NVD