Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,509
Total alertas
3066
Críticas
10171
Altas
8
Ransomware
1810
Esta semana
RSS
cwe-89 × Limpiar todo ×
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63232] A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att…
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63233] A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att…
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63234] A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att…
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-54658] Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/c…
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-7769] IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 throug…
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in t…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-14785] The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' …
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that ca…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-16462] In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unaut…
In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
28/07/2026
[CVE-2026-10207] The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up t…
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp_unslash() which removes WordPress's magic quotes protection, followed by direct concatenation into a SQL query without proper es…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-13161] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to gene…
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addition…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-14516] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL qu…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-12800] The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Inje…
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method witho…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-12741] The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic…
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queri…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-51077] SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive infor…
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-17191] An input validation vulnerability exists in an API component of the orchestrator. An authenticated u…
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not awa…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2025-50455] SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Al…
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments
nvdcriticovulnerabilidad CVSS 9.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
27/07/2026
[CVE-2026-66427] Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
Administrator SQL Injection in WP Google Review Slider
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59550] Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
Unauthenticated SQL Injection in AWP Classifieds
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59551] Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59537] Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommer…
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59538] Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.
Unauthenticated SQL Injection in GamiPress
nvdcriticovulnerabilidad CVSS 9.3 NVD