Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57756] Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.

Contributor SQL Injection in nicen-localize-image

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57683] Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

Unauthenticated SQL Injection in WP Fast Total Search

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57687] Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.

Contributor SQL Injection in Custom Field Template

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57679] Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

Unauthenticated SQL Injection in GeekyBot

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2025-69094] Subscriber SQL Injection in Unicamp <= 2.2.2 versions.

Subscriber SQL Injection in Unicamp

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-8441] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' p…

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeri…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-52186] SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to e…

SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-14363] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-58521] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34101] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34102] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_i…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34103] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subti…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34104] Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in des…

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34105] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in trans…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34099] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_i…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET['id'].\"'. No authentication is required. An unauthenticated attacker can perform error-based SQL injection to extract the database version, current user, schema names, and table contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34100] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-57517] Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthe…

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshe…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-11823] The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the…

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-55721] Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by t…

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58376] Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows…

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only …

nvdaltovulnerabilidad CVSS 7.6 NVD