Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100713] Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH ke…

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::makeCorrectDir()/makeCorrectFile() is done only at check time; the live filesystem path is re-resolved as root at write time (file_put_contents with FILE_APP…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100714] Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlik…

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safe_exec. Because safe_exec only bla…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100716] Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (…

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100697] Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.…

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST contain…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100673] The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render s…

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor wh…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100315] A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c…

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

Inyección SQL alta en CloudClassroom-PHP-Project afecta plataformas educativas

Se ha identificado una vulnerabilidad de inyección SQL en CloudClassroom-PHP-Project (hasta versión 5dadec098bfbbf3300d60c3494db3fb95b66e7be) que permite manipular el parámetro 'eno' en el archivo updatedetailsfromstudent.php. El ataque es remotamente explotable y el exploit ha sido divulgado públicamente. Instituciones educativas y plataformas de aprendizaje en LATAM que usen este software están en riesgo inmediato de comprometimiento de bases de datos estudiantiles.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

26/09/2026

Vulnerabilidad crítica de carga arbitraria de archivos en plugin Request a Quote for WooCommerce

El plugin Request a Quote for WooCommerce para WordPress es vulnerable a carga arbitraria de archivos en versiones hasta la 2.9.2 debido a validación insuficiente de extensiones y tipos MIME en la función afrfq_submit_quote_via_popup(). Un atacante puede cargar archivos maliciosos (como shells PHP) directamente al servidor sin restricción, comprometiendo completamente sitios de comercio electrónico en LATAM. Con CVSS 9.8, afecta principalmente a pequeñas y medianas empresas que usan este plugin para gestionar cotizaciones de productos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100520] Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/uploa…

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-100389] GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP conne…

GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-100372] ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor…

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97882] A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6…

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97883] A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec09…

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is use…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97885] A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3…

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-50547] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequenc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-62262] Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earl…

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings[] value and then open the returned search URL. include/ws_functions/pwg.images.php stores the unvalidated value in the search rules, and include/functions_search.inc.php integer-cas…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-39353] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as publi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-42322] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-42323] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-42324] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.in…

nvdaltovulnerabilidad CVSS 7.2 NVD