Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1023
Esta semana
RSS
cwe-89 × 30 días × Limpiar todo ×
M Alto vulnerabilidad
01/10/2026
[CVE-2026-103338] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
01/10/2026
[CVE-2026-102379] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
01/10/2026
[CVE-2026-103253] n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL…
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
nvdaltovulnerabilidad CVSS 8.7 NVD
M Crítico vulnerabilidad
01/10/2026
[CVE-2026-103248] n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filt…
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Alto vulnerabilidad
01/10/2026
[CVE-2026-89296] The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter be…
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
01/10/2026
[CVE-2026-81809] The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from pay…
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102109] A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the…
A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature i…
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102098] Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerabi…
Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected repor…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103232] A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf…
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The proje…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103229] A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e…
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be u…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103230] A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf…
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-103231] A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf…
A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The proj…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-62097] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-18782] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-82307] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
30/09/2026
[CVE-2026-97293] Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
Contributor SQL Injection in Media LIbrary Assistant
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-97287] Contributor SQL Injection in Event Tickets <= 5.29.5 versions.
Contributor SQL Injection in Event Tickets
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-96827] Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
Administrator SQL Injection in Admin Notices Manager
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-96828] Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
Administrator SQL Injection in Category Discount Woocommerce
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-96822] Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
Unauthenticated SQL Injection in Books Gallery
nvdcriticovulnerabilidad CVSS 9.3 NVD