Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19764] A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up…

A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73408] Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mys…

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72851] Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered …

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72853] Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's p…

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's database user to read or modify arbitrary data.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16961] IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafte…

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2024-58374] Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet en…

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2019-25765] ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthent…

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation e…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-59109] SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in re…

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Da…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73670] A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authentica…

A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database sch…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19710] A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vuln…

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73346] Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66658] Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

Subscriber SQL Injection in Reviewer

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-66472] Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

Unauthenticated SQL Injection in Everest Backup

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-66478] Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

Unauthenticated SQL Injection in Church Admin

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-66458] Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

Unauthenticated SQL Injection in RealPress

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-66436] Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

Unauthenticated SQL Injection in Active Products Tables for WooCommerce

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-66446] Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

Subscriber SQL Injection in If-So Dynamic Content Personalization

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66430] Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-61969] Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

Unauthenticated SQL Injection in Listdom

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-61966] Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

Subscriber SQL Injection in WPJAM Basic

nvdcriticovulnerabilidad CVSS 9.3 NVD