Alertas de Seguridad de la Información

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-57517] Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthe…

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshe…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-11823] The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the…

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-55721] Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by t…

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58376] Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows…

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-8402] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. SYSGUARD 6001 allows Blind SQL Injection. This issue affects SYSGUARD 6001: from 2.0.2 before 6.1.16.0.  NOTE: The vendor was contacted and it was learned that the product is not supported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-13766] DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. …

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quote_char, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers (order_by, where-clause column keys, field and returning lists, upsert columns, and join aliases) reach the SQL string ra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-9711] The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to S…

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57955] SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to…

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to per…

nvdaltovulnerabilidad CVSS 8.5 NVD

S Alto vulnerabilidad

29/06/2026

[CVE-2026-13744] Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allow…

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to pr…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-40523] FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handl…

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-40524] FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() fu…

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolea…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-40522] FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report ha…

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13565] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affect…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_class1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13566] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by …

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /preview3.php. The manipulation of the argument course_year_section leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13559] A weakness has been identified in code-projects Real State Services 1.0. Impacted is an unknown func…

A weakness has been identified in code-projects Real State Services 1.0. Impacted is an unknown function of the file /single-list_sale.php?action=add. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13555] A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue…

A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/mod_users/controller.php?action=add. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13552] A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unk…

A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/mod_amenities/controller.php?action=edit. Performing a manipulation of the argument amen_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13550] A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impact…

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13551] A security vulnerability has been detected in itsourcecode Baptism Information Management System 1.0…

A security vulnerability has been detected in itsourcecode Baptism Information Management System 1.0. This affects an unknown function of the file /editBaptism.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13527] A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. The affected…

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /preview4.php. Such manipulation of the argument course_year_section leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD