Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/08/2026

Inyección SQL alta en itsourcecode Online Clinic Management System 1.0

Se ha identificado una vulnerabilidad de inyección SQL en el módulo de login administrativo (success/login.php) de itsourcecode Online Clinic Management System versión 1.0, permitiendo ejecución remota no autenticada mediante manipulación del parámetro Username. La vulnerabilidad ha sido divulgada públicamente (CVSS 7.3) y afecta directamente a clínicas y centros médicos en LATAM que utilizan este sistema para gestionar datos sensibles de pacientes.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

24/08/2026

Inyección de Objetos PHP sin autenticación en FreightCo <= 1.1.15

FreightCo versiones 1.1.15 y anteriores contienen una vulnerabilidad crítica (CVSS 9.8) que permite inyección de objetos PHP sin requerir autenticación. Esta falla afecta directamente a empresas logísticas y de transporte en LATAM que utilizan esta plataforma para gestión de cargas, permitiendo a atacantes ejecutar código arbitrario y comprometer completamente los sistemas. La ausencia de controles de autenticación previos amplifica significativamente el riesgo de explotación remota.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78245] A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_upl…

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78244] A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this iss…

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78202] A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting…

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78201] A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the funct…

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78199] A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is a…

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78198] A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0.…

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Such manipulation of the argument pid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78197] A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulner…

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78171] A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vuln…

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/08/2026

[CVE-2026-78143] A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. A…

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/08/2026

Vulnerabilidad alta de inyección de objetos PHP en plugin PPWP para WordPress (CVE-2026-0551)

El plugin Password Protect Pages (PPWP) para WordPress en versiones hasta 1.9.18 es vulnerable a inyección de objetos PHP mediante deserialización insegura del parámetro 'post_protection_roles'. Atacantes autenticados con acceso de Colaborador o superior pueden ejecutar código arbitrario en servidores web. Esta vulnerabilidad afecta principalmente a sitios corporativos y de comercio electrónico en México y LATAM que protegen contenido sensible con este plugin.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

22/08/2026

Vulnerabilidad crítica de inyección de objetos PHP en plugin WS Form LITE para WordPress

El plugin WS Form LITE (versiones hasta 1.10.80) para WordPress contiene una vulnerabilidad de inyección de objetos PHP (CVE-2026-4703, CVSS 9.8) que permite a atacantes no autenticados inyectar objetos maliciosos a través de la deserialización de datos en envíos de formularios. Este riesgo afecta directamente a miles de sitios WordPress en México y Latinoamérica que utilizan este constructor de formularios, exponiendo datos sensibles de contacto y potencialmente comprometiendo la integridad del servidor.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

22/08/2026

[CVE-2026-58003] WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the relea…

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanently publish any embargoed video by manipulating the videos_id parameter.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/08/2026

[CVE-2026-59256] WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() …

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restric…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/08/2026

Vulnerabilidad crítica de carga de archivos sin restricción en xShop 3.0.3 (CVE-2026-49849)

xShop, plataforma de e-commerce de código abierto basada en Laravel, contiene una vulnerabilidad de carga de archivos sin validación que permite a administradores autenticados subir y ejecutar archivos PHP, logrando ejecución remota de código (RCE) con acceso total al servidor. Afecta directamente a tiendas en línea operadas por pequeñas y medianas empresas en LATAM. La versión 3.0.4 corrige el problema.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

21/08/2026

Vulnerabilidad alta de bypass de autenticación en Combodo iTop anterior a v3.2.3

Combodo iTop, herramienta web de gestión de servicios de TI, contiene una vulnerabilidad de bypass de autenticación (CVSS 8.6) que permite a atacantes no autenticados ejecutar archivos PHP arbitrarios desde el directorio env-production en instancias nuevas. Afecta altas funciones de ITSM en empresas LATAM. La vulnerabilidad se ha corregido en versión 3.2.3.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-63135] YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS …

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-31803] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected …

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-30819] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 7.3 NVD