Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20267] Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthe…

Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the category_id parameter. Attackers can send GET requests to the events view with malicious SQL code in the category_id parameter to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20255] Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated at…

Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the visatype parameter. Attackers can send GET requests to index.php with the option=com_bookpro and view=popup parameters, injecting SQL commands in the visatype parameter to extract sensitive database information includin…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20256] Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated…

Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the invite parameter. Attackers can send GET requests to the component with crafted SQL payloads in the invite parameter to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20257] Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthentica…

Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the ajaxaction.flag_question task. Attackers can inject malicious SQL code via the stu_quiz_id or flag_quest parameters to manipulate database queries and extract sensitive information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20258] Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows…

Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20259] Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attacke…

Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_osdownloads&view=item&id=[SQL] to extract sensitive database information including credentials and configuration data.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20260] Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthentica…

Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the product_id parameter to extract sensitive database information including credentials and configuration d…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20261] Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauth…

Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can supply crafted SQL statements in GET requests to the brainy and alice views to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20262] Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated …

Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter. Attackers can send GET requests to index.php with the option=com_ajaxquiz and view=ajaxquiz parameters to extract sensitive database information including table names and column structures.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20253] Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticate…

Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20254] Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated…

Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with the option=com_userbench&view=detail&userid parameter containing SQL injection payloads to extract sensitive database information including credenti…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20252] Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated atta…

Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname parameter. Attackers can send GET requests to index.php with option=com_nge&view=config and inject malicious SQL code in the plname parameter to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2020-37252] Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.…

Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with LocalSystem privileges during service startup or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2020-37253] Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service tha…

Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service that allows local attackers to escalate privileges. Attackers can place malicious executables in the Program Files directory to be executed with LocalSystem privileges when the service starts.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2020-37254] Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted servic…

Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2021-47985] Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint service bina…

Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint service binary that allows local attackers to escalate privileges. Attackers can place a malicious executable in the Program Files directory path to be executed with LocalSystem privileges when the service starts automatically.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2023-54353] Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that…

Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files (x86)\Personify\ can place a malicious Program.exe or PsyFrameGrabberService.exe file that executes with LocalSy…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2025-71326] AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that…

AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that execute with high-level system permissions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20092] NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 s…

NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that will be executed during service startup or system reboot, resulting in privilege escalation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20093] Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the W…

Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and SpyHunter 4 Service respectively, allowing local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that execute during service startup or system reboot with elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD