Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66633] Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-45733] Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe…

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32547] Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32333] Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-28568] Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Quill Forms

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-28569] Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

Unauthenticated Cross Site Scripting (XSS) in SSL Zen

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad XSS almacenado alta en Grav anterior a 2.0.15 afecta renderizado de multimedia

Grav versiones anteriores a 2.0.15 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en el renderizado de medios de audio y video. Un atacante puede inyectar código JavaScript arbitrario a través de fragmentos de URL en elementos media, ejecutándose en las sesiones de usuarios que visualizan el contenido afectado. Esta vulnerabilidad impacta plataformas de contenido en empresas LATAM que utilizan Grav para gestión de portales web y repositorios multimedia.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad XSS almacenado alta en Grav antes de 2.0.15 afecta editores autenticados

Grav versiones anteriores a 2.0.15 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la función detectXss() que permite a editores autenticados inyectar manejadores de eventos (como onerror=) que eluden la validación y se ejecutan en navegadores de visitantes. Esta vulnerabilidad afecta particularmente a empresas en LATAM que utilizan Grav para portales corporativos, sitios de contenido y plataformas de gestión de información con múltiples editores.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-74902] SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flo…

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-75626] SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s…

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75091] The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnera…

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-33437] Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P…

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75048] In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was po…

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-55674] Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0…

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-74998] In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style S…

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-74800] SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when servin…

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad XSS almacenado alta en plugin Infility Global para WordPress (CVE-2026-10734)

El plugin Infility Global para WordPress es vulnerable a Cross-Site Scripting (XSS) almacenado en el endpoint /cf7_record_log en versiones hasta 2.15.21. Atacantes no autenticados pueden inyectar scripts maliciosos que se ejecutan cuando usuarios acceden a páginas comprometidas, comprometiendo datos de formularios de contacto y sesiones de clientes. Afecta a sitios en WordPress que utilizan este complemento para gestionar registros de formularios Contact Form 7.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad XSS almacenado en plugin Bookly para WordPress afecta tiendas en línea

El plugin de reservas Bookly para WordPress (versiones hasta 27.7) permite a atacantes no autenticados inyectar scripts maliciosos mediante la acción AJAX bookly_speed_up_update_addons, aprovechando sanitización insuficiente. Afecta directamente a pequeñas y medianas empresas en LATAM que dependen de WordPress para gestión de citas y reservas. La ejecución del código malicioso ocurre en páginas visitadas por clientes y administradores.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad de Scripting Almacenado en plugin Platnosci Online Blue Media (Autopay) para WordPress

El plugin Platnosci Online Blue Media (Autopay) para WordPress, versiones hasta 5.0.0, es vulnerable a Cross-Site Scripting (XSS) almacenado a través del parámetro POST 'bm_woocommerce_css_editor_content'. La falla reside en el método Css_Editor::handle_save() que carece de validación de capacidades, verificación de nonce y sanitización de entrada, permitiendo a atacantes inyectar código malicioso sin autenticación. Este vector impacta tiendas de comercio electrónico en LATAM que dependen de WooCommerce para procesar pagos y gestionar inventario.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73052] SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them d…

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.

nvdcriticovulnerabilidad CVSS 9.0 NVD