Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/06/2026

[CVE-2026-36670] A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Pa…

A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2019-25746] WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows au…

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20071] The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injecti…

The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20072] BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unaut…

BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user inf…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20073] Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unau…

Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20068] WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injecti…

WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id'…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20069] WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulne…

WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-6428] SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before…

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-9848] The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query par…

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_author_search_results()` when the current request is an unauthenticated front-end search. That function reads `$query->query_vars['s']` — al…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-44172] MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an appli…

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-45060] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-45418] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authentic…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-39494] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-42647] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-38581] SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attacker…

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php (line 14) and the id parameter (line 49). The parameters are concatenated directly into SQL queries without sanitization or parameterized statements.

nvdcriticovulnerabilidad CVSS 9.8 NVD

K Crítico vulnerabilidad

10/06/2026

[CVE-2026-53474] A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerabil…

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information s…

nvdcriticovulnerabilidad CVSS 9.6 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52758] Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user…

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-49498] Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of Pos…

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in PasswordChange network messages to escalate to PostgreSQL superuser privileges and gain full database cont…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-3018] The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscrib…

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-3326] The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before usi…

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

nvdaltovulnerabilidad CVSS 8.6 NVD