Alertas de Seguridad de la Información

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45073] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion sco…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47295] Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a…

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47296] Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a…

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15703] A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulner…

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15736] Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: I…

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the applica…

nvdaltovulnerabilidad CVSS 8.3 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-62390] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15676] A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted eleme…

A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15675] A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an un…

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51821] SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacke…

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15597] A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. T…

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61955] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-59515] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57810] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57787] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57771] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57772] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57773] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57739] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57726] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57714] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through

nvdcriticovulnerabilidad CVSS 9.3 NVD