Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/08/2026

Exposición de datos sensibles sin autenticación en WP Cafe Pro < 3.0.15

WP Cafe Pro versiones anteriores a 3.0.15 contienen una vulnerabilidad que permite el acceso a datos sensibles sin requerir autenticación. Afecta principalmente a sitios WordPress de cafeterías, restaurantes y negocios similares en LATAM que utilizan este plugin para gestionar menús, pedidos y configuraciones. Con CVSS 7.5, esta vulnerabilidad expone información alta del negocio y datos de clientes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

Vulnerabilidad XSS sin autenticación en WPComplete versiones <= 2.9.5.6

Se ha identificado una vulnerabilidad de Cross Site Scripting (XSS) sin autenticación en el plugin WPComplete que afecta versiones hasta la 2.9.5.6. Esta falla permite a atacantes inyectar código malicioso en sitios WordPress expuestos, comprometiendo la integridad de datos y robando sesiones de administradores. Es especialmente alta para empresas LATAM con presencia digital en WordPress, plataforma dominante en la región.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

Inyección SQL alta en ProLancer Element versiones ≤ 1.4.8

Se ha identificado una vulnerabilidad de inyección SQL en ProLancer Element que afecta todas las versiones hasta la 1.4.8, con puntuación CVSS de 8.5 (alta). Esta falla permite a atacantes ejecutar consultas SQL arbitrarias a través del módulo de suscriptores, comprometiendo la integridad y confidencialidad de bases de datos. Empresas en LATAM que utilizan esta plataforma para gestión de proyectos o freelancing están expuestas a robo de datos sensibles y acceso no autorizado.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

24/08/2026

XSS no autenticado alta en Brave Conversion Engine (PRO) versiones ≤ 0.8.6

Se ha identificado una vulnerabilidad de Cross Site Scripting (XSS) sin autenticación en Brave Conversion Engine (PRO) versiones 0.8.6 y anteriores, con CVSS 7.1. Esta falla permite a atacantes inyectar código malicioso que se ejecuta en navegadores de usuarios finales, comprometiendo sesiones y datos sensibles. Empresas en México y LATAM que utilizan esta herramienta para conversión de contenido o procesamiento de documentos están expuestas a ataques dirigidos y robo de credenciales.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

Eliminación arbitraria de archivos sin autenticación en ShopBuilder Pro ≤ 2.2.0

ShopBuilder Pro, extensión de Elementor para WooCommerce, presenta una vulnerabilidad alta (CVSS 8.6) que permite a atacantes no autenticados eliminar archivos arbitrarios del servidor. Afecta directamente a tiendas en línea y sitios de comercio electrónico en México y LATAM que utilizan versiones anteriores a 2.2.1. El riesgo es severo: pérdida de datos altas, degradación de servicios y potencial exposición de información sensible.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-28162] Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Events Made Easy

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-28166] Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Tourmaster

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78245] A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_upl…

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78244] A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this iss…

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-10582] Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRem…

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actua…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-75931] fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input …

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-75975] fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validat…

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, whic…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78314] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78315] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78316] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78317] SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-66897] A path traversal vulnerability in LXD's instance template processing allows an attacker with contain…

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-75899] fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and th…

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78202] A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting…

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78201] A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the funct…

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD