Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105172] A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is …

A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is some unknown functionality of the file /login1.php. Performing a manipulation of the argument User results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105169] A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca…

A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument order_id/delivery_person_id results in sql injection. It is possible to launch the attack remotely. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/10/2026

[CVE-2026-105170] A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f…

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes missing authentication. The attack can be initiated remotely. The exploit has been made available to the p…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/10/2026

[CVE-2026-105166] A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145…

A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is the function insert of the file fooddonateform.php of the component Food Donation Form. Performing a manipulation of the argument image-choice results in sql injection. The attack is possible to be carried out remotely. The e…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/10/2026

[CVE-2026-105167] A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f…

A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file admin/donate.php. Executing a manipulation of the argument location can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be u…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/10/2026

[CVE-2026-105089] WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users wi…

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

04/10/2026

Vulnerabilidad alta de ejecución remota de código en W (wcms) versión 3.18.0 y anteriores

W (vincent-peugnet/wcms) versión 3.18.0 y anteriores contiene una vulnerabilidad de ejecución remota de código (RCE) que permite a editores autenticados escribir archivos arbitrarios mediante la validación insuficiente en POST /api/v0/media/upload/[*:path]. Los atacantes pueden cargar archivos PHP ejecutables, utilizar secuencias codificadas ../ para escribir fuera del directorio de medios, y eliminar archivos arbitrarios. Esta vulnerabilidad afecta principalmente a plataformas de gestión de contenidos desplegadas en servidores web de empresas mexicanas y latinoamericanas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad alta de inclusión de archivos en plugin WPCafe para WordPress

El plugin WPCafe para WordPress (versiones hasta 3.0.18) contiene una vulnerabilidad de Local File Inclusion (LFI) que permite a usuarios con acceso de colaborador o superior ejecutar archivos PHP arbitrarios en el servidor. Esta vulnerabilidad afecta directamente a restaurantes, cafeterías y negocios de alimentos en LATAM que utilizan este plugin para sistemas de pedidos en línea y reservas de mesas, comprometiendo la integridad del sitio web y datos de clientes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad XSS almacenado alta en plugin WP Mail Catcher para WordPress (CVE-2026-93889)

El plugin WP Mail Catcher para WordPress es vulnerable a inyección de scripts maliciosos almacenados (Stored XSS) a través de mensajes de error de PHPMailer en versiones hasta 2.1.12. Atacantes no autenticados pueden inyectar código JavaScript que se ejecuta cuando usuarios acceden a páginas comprometidas, poniendo en riesgo datos sensibles y sesiones administrativas. Afecta especialmente a sitios empresariales en LATAM que utilizan este plugin para gestionar logs de correo.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-104478] Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authe…

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104991] Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API i…

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2014-125130] CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contai…

CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104637] A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473…

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient of the file php/controller.php. Executing a manipulation of the argument img can lead to unrestricted upload. The attack may be launched remo…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

Vulnerabilidad alta de carga de archivos sin restricción en YesWiki anterior a 4.6.7

YesWiki versiones anteriores a 4.6.7 presentan una vulnerabilidad de carga de archivos no restringida que permite a administradores autenticados ejecutar código PHP malicioso en el servidor mediante la importación de CSV en Bazar. Un atacante puede importar un archivo CSV con referencias a URLs PHP remotas que se guardan sin validación de extensión y se ejecutan como código del lado del servidor, comprometiendo la integridad del sitio web y los datos alojados.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

Inyección SQL alta en onetwothreeneth HospitalManagementSystem permite acceso remoto no autorizado

Se identificó una vulnerabilidad de inyección SQL en onetwothreeneth HospitalManagementSystem (hasta versión 9ef91ed6007314b6473110ed699dff76d158f61d) en el archivo edit_accounts.php. Un atacante remoto puede manipular los parámetros user_id, patient_id, physician_id, discounts_id o services_id para ejecutar comandos SQL arbitrarios, comprometiendo bases de datos de pacientes, registros clínicos y datos sensibles. La explotación es posible sin autenticación previa y el exploit ya está disponible públicamente.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

Inyección SQL ciega en YesWiki anterior a 4.6.7 permite lectura de datos arbitrarios

YesWiki versiones anteriores a 4.6.7 contiene una vulnerabilidad de inyección SQL ciega en la acción {{newtextsearch}} que permite a atacantes anónimos explotar opciones de listas Bazar sin escapado en la consulta SQL. Los atacantes pueden manipular opciones en listas editables anónimamente y usar solicitudes de búsqueda como oráculo booleano para extraer datos sensibles de la base de datos, incluyendo credenciales e información confidencial. Afecta principalmente a wikis colaborativas en LATAM con acceso público o semi-público.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-92174] The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all vers…

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to by…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-91828] The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not …

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-10026] The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and inc…

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104123] A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by th…

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD