Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/09/2026

[CVE-2026-61815] zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear librar…

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header injection (CWE-93) affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment f…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-61816] zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear librar…

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-62368] Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.crea…

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session.…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-63498] Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint G…

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist use…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-56737] phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authenticati…

phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including adm…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-56736] phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in…

phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

24/09/2026

Vulnerabilidad crítica de inclusión de archivos en Visual Composer Website Builder para WordPress

El plugin Visual Composer Website Builder para WordPress (versiones hasta 45.16.0) contiene una vulnerabilidad de inclusión local de archivos (LFI) que permite a atacantes no autenticados ejecutar código PHP arbitrario en el servidor. Esta falla afecta directamente a miles de sitios web en México y LATAM que utilizan este constructor visual, comprometiendo datos sensibles y permitiendo control total del servidor.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/09/2026

Vulnerabilidad alta en MasterStudy LMS permite ejecución de código PHP arbitrario

El plugin MasterStudy LMS para WordPress anterior a la versión 3.7.50 no valida correctamente los parámetros de configuración de estilo de visualización, permitiendo que usuarios con rol de Colaborador o superior incluyan y ejecuten archivos PHP arbitrarios en el servidor. Esta vulnerabilidad afecta principalmente a instituciones educativas y plataformas de capacitación en LATAM que utilizan este plugin para gestión de cursos en línea, comprometiendo la confidencialidad e integridad de datos de estudiantes y contenido académico.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/09/2026

Vulnerabilidad de deserialización en plugin wpForo Forum WordPress anterior a v3.1.6

El plugin wpForo Forum para WordPress anterior a la versión 3.1.6 permite a usuarios autenticados con nivel Subscriber o superior inyectar objetos PHP maliciosos mediante campos de perfil sin validar durante la deserialización. La vulnerabilidad se amplifica si otros plugins wpForo instalados contienen cadenas de Property-Oriented Programming (POP) que pueden ser explotadas para ejecución de código remoto. Afecta principalmente a sitios empresariales en LATAM que utilizan este plugin para comunidades o foros internos.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

Vulnerabilidad alta de traversal de directorios en ShopXO hasta versión 2.2.7

Se detectó una vulnerabilidad de traversal de directorios en ShopXO versión 2.2.7 y anteriores en el componente Ueditor Upload Interface (archivo config/ueditor.php). Un atacante remoto puede manipular el parámetro path_type para acceder a archivos fuera del directorio permitido. El exploit es público y activo; afecta directamente a plataformas de comercio electrónico en LATAM que utilizan este CMS.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-96751] A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a081…

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96603] A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_lo…

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release syst…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96604] A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the functi…

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-93352] Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .ph…

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file tha…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96601] A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of t…

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version informati…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96602] A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file…

A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-19125] The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all version…

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96556] A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function …

A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not res…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-95603] Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.

Shop manager PHP Object Injection in Reycob Product Import Export

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96513] A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown p…

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, a…

nvdaltovulnerabilidad CVSS 7.3 NVD