Alertas de Seguridad de la Información

M Crítico vulnerabilidad

13/10/2026

[CVE-2026-54454] OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and h…

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import pat…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109620] A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulner…

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109606] A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the f…

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109607] A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of t…

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

13/10/2026

[CVE-2026-55695] FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.…

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifyin…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-110025] A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown proce…

A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file include/inc_front/content/cnt23.article.inc.php of the component Extension Check. This manipulation of the argument POST_name causes unrestricted upload. The attack can be initiated remotely. Upgrading to version 1.9.50 and 1.12.4 is capable of addressing this issue. Patch name: 11…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109525] A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca…

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109605] A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This af…

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109521] A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca25…

A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109522] A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca…

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109523] A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d3…

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be use…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109960] Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authent…

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109114] A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcf…

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and ma…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109115] A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e…

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. C…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108973] A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue …

A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108974] A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function sa…

A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108975] A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerabil…

A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108972] A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this v…

A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108970] A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbf…

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be u…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108969] A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e6…

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been dis…

nvdaltovulnerabilidad CVSS 7.3 NVD