Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25753] Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated att…

Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25754] Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticat…

Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keysearch parameter. Attackers can send POST requests to the menu-listing-layout endpoint with crafted SQL payloads in the keysearch parameter to extract database table names and sensitive information from the data…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25749] Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attack…

Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the guest_adult parameter. Attackers can send POST requests to the cruises endpoint with crafted SQL payloads in the guest_adult parameter to extract sensitive database information or manipulate database records.

nvdaltovulnerabilidad CVSS 7.1 NVD

T Crítico vulnerabilidad

19/06/2026

[CVE-2026-51846] In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack b…

In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can lead to remote arbitrary code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56209] An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation…

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is full…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56210] A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementatio…

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can inf…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-56211] A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. I…

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-49260] PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version …

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.5.1, `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escapeshellarg('/usr/local/bin/weasyprint')` returns `'/usr/local/bin/weasyprint'` with the …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-3195] A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `vir…

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20278] Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticate…

Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the category parameter. Attackers can send GET requests to the all-recipes endpoint with malicious SQL payloads in the category path segment to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20279] Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to …

Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the aid parameter. Attackers can send GET requests to index.php with malicious aid values in the make_payment task to extract sensitive database information using boolean-based blind or time-based blind techniques.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20280] Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticat…

Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid endpoint to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20281] Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthentic…

Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the establename parameter. Attackers can send GET requests to index.php with the option=com_extrasearch parameter and malicious SQL in the establename field to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20282] Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthe…

Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25748] Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated a…

Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rooms parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL payloads in the rooms parameter to extract sensitive database information including version details.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20270] Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated …

Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username and id parameters. Attackers can send GET requests to index.php with option=com_twitchtv and view parameters containing SQL injection payloads to extract sensitive database information including credentials a…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20271] Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated a…

Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with the option=com_streetguess&view=maps parameters and inject SQL code in the catid parameter to extract sensitive database information including version …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20272] Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthent…

Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the sf_selectuser_id parameter. Attackers can send GET requests to index.php with the option=com_upl and view=propertylisting parameters to extract sensitive database information including table names and column st…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20273] Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows una…

Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_registrationpro&view=category&id parameter containing SQL injection payloads to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20274] Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthentic…

Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cp_id parameter. Attackers can send GET requests to index.php with the option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath parameters to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD