Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Php" — 1427 resultados ✕ Limpiar búsqueda
26,354
Total alertas
5292
Críticas
20184
Altas
8
Ransomware
1768
Esta semana
RSS
M Alto vulnerabilidad
30/09/2026
[CVE-2026-97291] Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103474] yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, a…
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-103475] yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting …
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102377] Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
Contributor PHP Object Injection in Photo Gallery by 10Web
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102392] Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons a…
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-100512] Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
Contributor PHP Object Injection in Nested Pages
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103232] A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf…
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The proje…
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103229] A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e…
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be u…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103230] A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf…
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103231] A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf…
A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The proj…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-97248] Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Unauthenticated PHP Object Injection in Booking Activities
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-96832] Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
Shop manager PHP Object Injection in Content Egg
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-96833] Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
Editor PHP Object Injection in Ultimate Addons for Contact Form 7
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-96831] Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Contributor PHP Object Injection in Themify Builder
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-96343] Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Custom role PHP Object Injection in WP ERP
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
30/09/2026
[CVE-2026-96344] Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Custom role PHP Object Injection in eCommerce Product Catalog
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-95531] Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Subscriber PHP Object Injection in Conversational Forms for ChatBot
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-94677] Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-94678] Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Contributor PHP Object Injection in Go Live Update Urls
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-94683] Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Contributor PHP Object Injection in DesignSetGo
nvdaltovulnerabilidad CVSS 8.8 NVD