Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1003
Esta semana
RSS
cwe-89 × Limpiar todo ×
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20255] Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated at…
Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the visatype parameter. Attackers can send GET requests to index.php with the option=com_bookpro and view=popup parameters, injecting SQL commands in the visatype parameter to extract sensitive database information includin…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20256] Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated…
Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the invite parameter. Attackers can send GET requests to the component with crafted SQL payloads in the invite parameter to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20257] Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthentica…
Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the ajaxaction.flag_question task. Attackers can inject malicious SQL code via the stu_quiz_id or flag_quest parameters to manipulate database queries and extract sensitive information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20258] Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows…
Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20259] Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attacke…
Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_osdownloads&view=item&id=[SQL] to extract sensitive database information including credentials and configuration data.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20260] Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthentica…
Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the product_id parameter to extract sensitive database information including credentials and configuration d…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20261] Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauth…
Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can supply crafted SQL statements in GET requests to the brainy and alice views to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20262] Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated …
Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cid parameter. Attackers can send GET requests to index.php with the option=com_ajaxquiz and view=ajaxquiz parameters to extract sensitive database information including table names and column structures.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20253] Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticate…
Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20254] Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated…
Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with the option=com_userbench&view=detail&userid parameter containing SQL injection payloads to extract sensitive database information including credenti…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2017-20252] Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated atta…
Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname parameter. Attackers can send GET requests to index.php with option=com_nge&view=config and inject malicious SQL code in the plname parameter to extract sensitive database information.
nvdaltovulnerabilidad CVSS 8.2 NVD
P Alto vulnerabilidad
19/06/2026
[CVE-2026-12044] SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<descripti…
SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS ''`` for a user-supplied description field. The Jinja templates for Domains (and their constraints), Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description directly inside a single-quoted SQL literal -- ``'{{ data.description }}'`` -- instead o…
nvdaltovulnerabilidad CVSS 8.8 NVD
P Crítico vulnerabilidad
19/06/2026
[CVE-2026-12045] Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence data…
Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to…
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Alto vulnerabilidad
18/06/2026
[CVE-2026-56012] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows Blind SQL Injection. This issue affects Media LIbrary Assistant: from n/a through 3.35.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Crítico vulnerabilidad
18/06/2026
[CVE-2026-54419] claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commi…
claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation, without sanitization, escaping,…
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
18/06/2026
[CVE-2026-55740] Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad)…
Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=$busid) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context. A remote…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
17/06/2026
[CVE-2026-54812] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors allows Blind SQL Injection. This issue affects Motors: from n/a through 1.4.109.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-54813] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. This issue affects SureDash: from n/a through 1.8.0.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Crítico vulnerabilidad
17/06/2026
[CVE-2026-54815] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-54818] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection. This issue affects Slimstat Analytics: from n/a through 5.4.11.
nvdaltovulnerabilidad CVSS 8.5 NVD