Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-111898] phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows K…

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-111901] phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability i…

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-111882] phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypas…

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-111884] phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when c…

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including super…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

Hace 4 días

Inyección de Objetos PHP en plugin LearnPress para WordPress hasta versión 4.4.10

El plugin LearnPress (versiones ≤4.4.10) permite inyección de objetos PHP mediante deserialización de entrada no confiable en el parámetro 'checkout-email' durante acciones AJAX de pago. Un atacante puede ejecutar código arbitrario en servidores WordPress utilizados en plataformas educativas y tiendas online en LATAM. La vulnerabilidad persiste porque sanitize_text_field() no elimina la sintaxis de objetos serializados, permitiendo almacenamiento malicioso en tablas de sesión de LearnPress.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 4 días

Vulnerabilidad alta de inyección de objetos PHP en plugin Kirki para WordPress

El plugin Kirki (versiones hasta 6.3.2) para WordPress es vulnerable a inyección de objetos PHP mediante deserialización de datos no confiables. La vulnerabilidad afecta a sitios WordPress con administradores comprometidos o con acceso no autorizado a paneles de control. En México y Latinoamérica, miles de sitios pequeños y medianos utilizan este constructor visual sin mantener parches actualizados, exponiendo bases de datos y contenido sensible.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-30971] ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1…

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-104730] The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPre…

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-104932] The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deser…

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-55872] GYM One is open-source gym management software for fitness centers, personal trainers, and sports cl…

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the ad…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111231] Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-onl…

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-leve…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111229] pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_…

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111220] pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that…

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111215] Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenti…

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0; via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interp…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-104827] react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.…

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-61611] Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has …

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an al…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-53582] OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust modul…

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager o…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-47168] EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authentic…

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code exe…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-81534] The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Executi…

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with su…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55680] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR co…

nvdcriticovulnerabilidad CVSS 9.8 NVD