Alertas de Seguridad de la Información

M Crítico vulnerabilidad

05/08/2026

Inyección SQL crítica en Miantang/IoT-PHP permite autenticación sin credenciales válidas

La aplicación Miantang/IoT-PHP contiene una vulnerabilidad de inyección SQL en la ruta POST /userlogin debido a que no sanitiza el parámetro de contraseña antes de concatenarlo en una consulta SQL raw. Un atacante puede eludir la autenticación ingresando caracteres especiales en el campo de contraseña. Esta vulnerabilidad afecta sistemas IoT y aplicaciones embebidas en infraestructuras críticas de LATAM, permitiendo acceso no autorizado a datos sensibles y control del dispositivo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71238] DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py ra…

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-66747] Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every pub…

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71231] IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM …

IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-44945] A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests…

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-10090] A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of…

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies t…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-10059] A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant admin…

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalatio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71213] Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, fa…

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71214] The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derive…

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura. By setting {"session_variab…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71207] The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password v…

The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can submit a payload such as ' OR '1'='1 in the login form to bypass authentication entirely. The same s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-70376] Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in …

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function's elseif branch returns true, treating the request as same-origin. Because a cross-site a…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-5581] The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary me…

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-61484] ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. Thi…

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supp…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-61486] ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issu…

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-4431] The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due…

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-15360] The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter …

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-15210] The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the …

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9273] The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vuln…

The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-45537] OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 an…

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component lengt…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-45100] OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3…

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 by…

nvdcriticovulnerabilidad CVSS 9.1 NVD