Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

Vulnerabilidad alta de inyección de objetos PHP en plugin Kirki para WordPress

El plugin Kirki (versiones hasta 6.3.2) para WordPress es vulnerable a inyección de objetos PHP mediante deserialización de datos no confiables. La vulnerabilidad afecta a sitios WordPress con administradores comprometidos o con acceso no autorizado a paneles de control. En México y Latinoamérica, miles de sitios pequeños y medianos utilizan este constructor visual sin mantener parches actualizados, exponiendo bases de datos y contenido sensible.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-30971] ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1…

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-104730] The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPre…

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-104932] The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deser…

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-55872] GYM One is open-source gym management software for fitness centers, personal trainers, and sports cl…

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the ad…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111231] Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-onl…

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-leve…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111229] pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_…

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111220] pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that…

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-111215] Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenti…

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0; via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interp…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-104827] react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.…

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-61611] Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has …

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an al…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-53582] OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust modul…

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager o…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-47168] EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authentic…

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code exe…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-81534] The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Executi…

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory. This makes it possible for authenticated attackers, with su…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55680] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-55681] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with acces…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-55682] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/segu…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55683] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/soc…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to exec…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55684] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/soc…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT state…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-110761] ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authent…

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

nvdaltovulnerabilidad CVSS 8.8 NVD