Alertas de Seguridad de la Información

D Alto vulnerabilidad

10/07/2026

[CVE-2026-56690] Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special E…

Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information exposure, and Unauthorized access.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15300] The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'l…

The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15290] The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Mem…

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via the search parameter in all versions up to, and including, 2.10.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59834] SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endp…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This iss…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-55208] Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1…

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15190] A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affect…

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of the file /login.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

09/07/2026

[CVE-2026-56292] Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnera…

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-5955] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection. This issue affects BiEticaret: before v3.3.57.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15135] A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an u…

A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulation of the argument update results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15137] A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability …

A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15134] A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by t…

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

I Crítico vulnerabilidad

08/07/2026

[CVE-2026-9074] IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated …

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-15062] SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior …

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially craft…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-15067] Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, incl…

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration and minting of long-lived access credentials. Exploitation requires the ability for an attacker to inf…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-59257] n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerabil…

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-8307] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6854] The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQ…

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6230] The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery'…

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-9700] The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter …

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-14471] Improper Neutralization of Special Elements in the metrics-service retention policy management compo…

Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry before 1.0.13 might allow an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position. To remediate this issue, users should upgrade to version 1.0.13 or later.

nvdaltovulnerabilidad CVSS 8.1 NVD