Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25762] Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows u…

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-49286] PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version …

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (wh…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-49287] Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, …

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets. This requires a front-end template that passes request input i…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25755] Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated …

Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cmId parameter. Attackers can send POST requests to the editReview task endpoint with URL-encoded SQL UNION statements in the cmId parameter to extract database information including usernames, passwords, and database…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25756] Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated…

Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25757] Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers t…

Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vproductid and userid parameters. Attackers can send POST requests to the component with crafted SQL payloads in these parameters to extract sensitive database information including version and database names.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25758] Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authent…

Joomla! Component vBizz 1.0.7 contains an unrestricted file upload vulnerability that allows authenticated attackers to upload arbitrary PHP files by submitting malicious files through the profile_pic parameter. Attackers can upload PHP files via POST requests to the employee view endpoint and execute them from the uploads directory to achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25759] Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated atta…

Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database nam…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25750] Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allow…

Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25751] Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unau…

Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the categorySearch, adType, and citySearch parameters to the displayads component to extract sensitive database information including usernames, da…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25752] Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unau…

Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=com_jbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to e…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25753] Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated att…

Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25754] Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticat…

Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keysearch parameter. Attackers can send POST requests to the menu-listing-layout endpoint with crafted SQL payloads in the keysearch parameter to extract database table names and sensitive information from the data…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25749] Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attack…

Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the guest_adult parameter. Attackers can send POST requests to the cruises endpoint with crafted SQL payloads in the guest_adult parameter to extract sensitive database information or manipulate database records.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56208] A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A …

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56209] An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation…

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is full…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56210] A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementatio…

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can inf…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56211] A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. I…

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-49260] PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version …

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg('/usr/local/bin/weasyprint')` returns `'/usr/local/bin/weasyprint'` with the …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-3195] A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `vir…

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

nvdaltovulnerabilidad CVSS 7.4 NVD