Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/09/2026

Vulnerabilidad SSRF alta en WWBN AVideo permite lectura de archivos locales sin autenticación

WWBN AVideo contiene una vulnerabilidad de falsificación de solicitud del lado del servidor (SSRF) en la función _json_decode que permite a atacantes no autenticados enviar rutas de archivos o URLs HTTP a login.json.php para leer archivos locales o acceder a servicios internos. Los resultados se interpretan como credenciales de acceso, exponiendo configuraciones sensibles, bases de datos y tokens de sistemas en empresas de LATAM que utilizan este software para streaming de video.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-14560] The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded fi…

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88023] Improper neutralization of special elements in data query logic in the GridFS component of the Mongo…

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-73699] FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated atta…

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-73694] FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinitio…

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-73698] FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple admin…

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values directly into an INSERT statement without parameterization. Because the underlying PDO connection uses emulated prepared statement…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-79987] A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission ca…

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81784] Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.

Unauthenticated PHP Object Injection in Wise Chat

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88872] AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery…

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, sets or clears any user's channel password without C…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88873] WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo…

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrators' browsers to request the endpoint, copying sensitive application log…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88874] AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enfor…

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers, in both the public applications list an…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88876] AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vu…

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes witho…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88869] AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scriptin…

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execu…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88870] WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo…

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a logged-in victim's PGP 2FA public key, causing lockout or enabling account takeover if the attacker kn…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88865] AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership …

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from getLiveKey.json.php and publish to their YouTube, Twitch, or RTMP destinations.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88867] WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contai…

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters `name` and `iconClass` to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later ech…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-64837] ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php,…

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-64838] ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and r…

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-82925] The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized…

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such insta…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-87925] A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc…

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument pro_name[] results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with…

nvdaltovulnerabilidad CVSS 7.3 NVD