Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Php" — 1430 resultados ✕ Limpiar búsqueda
26,377
Total alertas
5296
Críticas
20202
Altas
8
Ransomware
1723
Esta semana
RSS
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69938] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the param…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69941] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=…
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69947] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-69930] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2025-65336] Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price…
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-67206] Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController tha…
Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger executio…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-67207] Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController t…
Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without admin…
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
30/07/2026
[CVE-2026-66416] Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attac…
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, P…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-57859] e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization h…
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the st…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-14602] The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing use…
The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2025-69945] kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php…
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2025-69949] kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php v…
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2025-67403] Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.…
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2025-67404] Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php…
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2025-67405] Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_passwo…
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.
nvdaltovulnerabilidad CVSS 7.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
29/07/2026
[CVE-2025-67406] https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. …
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate_case.php in parameter id endpoint of Advocate office management system. Unsanitized user input in the specified parameter is i…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2025-67407] Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_studen…
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2025-67408] Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.ph…
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2025-69942] kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient…
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2025-69943] kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the pa…
kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.
nvdcriticovulnerabilidad CVSS 9.8 NVD