Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 1 día

[CVE-2015-20124] Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability t…

Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2015-20125] Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that all…

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence wa…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2016-20100] Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability …

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2016-20101] Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allow…

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first o…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2014-125133] NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows un…

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Founda…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2014-125134] ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthe…

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was fir…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2015-20123] Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that all…

Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was fi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2012-20002] TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability …

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the …

nvdaltovulnerabilidad CVSS 7.5 NVD

? Informativo alerta

Hace 1 día

PHP alerta sobre dos vulnerabilidades críticas; parches de emergencia disponibles mañana

El equipo de seguridad de PHP ha emitido una advertencia a los administradores para que se preparen ante actualizaciones de seguridad de emergencia que estarán disponibles mañana, destinadas a corregir dos vulnerabilidades críticas. Según reporta BleepingComputer, la información

usanoticiasbleepingcomputer Editorial

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad alta de inyección PHP en DokuWiki permite ejecución remota de código

DokuWiki versiones anteriores a 2026-07-14c contiene una vulnerabilidad de inyección de objetos PHP en la función Draft::getDraftText() que deserializa contenido sin validar clases permitidas. Usuarios autenticados con permisos de edición pueden explotar condiciones de carrera para instanciar gadgets maliciosos (MemoryIndex, Installer) y ejecutar código arbitrario, escribir o eliminar archivos en el servidor. Afecta especialmente a wikis corporativas y portales de conocimiento en empresas medianas de LATAM.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

Inyección SQL alta en Osclass 8.3.1 y anteriores permite acceso no autorizado

Se identificó una vulnerabilidad de inyección SQL en el controlador Item Model Handler de Osclass (versiones hasta 8.3.1) que permite a atacantes remotos manipular consultas SQL mediante el parámetro sPattern en la función Item::findUserItems. Esta vulnerabilidad afecta principalmente a plataformas de clasificados en LATAM que utilizan este CMS de código abierto. El exploit está disponible públicamente, elevando el riesgo de explotación inmediata.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112301] A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue …

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112777] Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() f…

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote co…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-107083] SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injectio…

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112368] An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an…

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be inte…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112307] sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject P…

sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112152] A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc…

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112153] A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365…

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The ex…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112150] A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519…

A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-112151] A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a4873…

A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remo…

nvdaltovulnerabilidad CVSS 7.3 NVD