Alertas de Seguridad de la Información

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-56036] Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

Unauthenticated SQL Injection in 워드프레스 결제 심플페이

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-54825] Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.

Unauthenticated SQL Injection in wpDataTables

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-54827] Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

Unauthenticated SQL Injection in Real Estate 7

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-54831] Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.

Unauthenticated SQL Injection in GeoDirectory

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-54820] Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.

Unauthenticated SQL Injection in JetBooking

nvdcriticovulnerabilidad CVSS 9.3 NVD

C Alto vulnerabilidad

25/06/2026

[CVE-2026-40083] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have S…

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unserialize(stripslashes(gnrv('selected_graphs_array'))). The cacti_unserialize() function calls unserialize() with allowed_classes set to fal…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-37149] GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL …

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54849] Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54843] Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

Unauthenticated SQL Injection in MDTF

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54829] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54836] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54838] Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

Subscriber SQL Injection in WC Vendors Marketplace

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54822] Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

Subscriber SQL Injection in SALESmanago & Leadoo

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12937] The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for Word…

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12077] The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' …

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin…

nvdaltovulnerabilidad CVSS 7.5 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9781] Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerab…

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURASDevice JSON-…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9782] Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDeviceDrive J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9783] Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vul…

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURemovableM…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9784] Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibraryPort J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9785] Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibrarySlot J…

nvdaltovulnerabilidad CVSS 8.8 NVD