Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/10/2026

[CVE-2026-55681] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with acces…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-55682] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/segu…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55683] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/soc…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to exec…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55684] WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/soc…

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT state…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-110761] ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authent…

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55573] e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controll…

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can fl…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-54554] FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.…

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Di…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-55572] e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and…

e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can in…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-110646] Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows…

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-104764] The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all …

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-104909] The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and…

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-103367] The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Incl…

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypas…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/10/2026

[CVE-2026-86787] The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from sup…

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-104800] The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and …

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included fil…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/10/2026

[CVE-2026-110002] The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all vers…

The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executab…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-63165] Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functi…

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extra…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

13/10/2026

[CVE-2026-63146] Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, atta…

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injectio…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-63149] Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows att…

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the le…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-82416] FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retai…

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_sta…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-85990] Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped…

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinar…

nvdaltovulnerabilidad CVSS 8.8 NVD