Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-108101] HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAtt…

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-107805] Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signatur…

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume tempo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-105278] The published Docker image for openPDC includes a fixed administrative credential with no forced cha…

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-104081] KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function wit…

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can u…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 22 horas

[CVE-2026-94067] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 22 horas

[CVE-2026-94066] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 22 horas

[CVE-2026-94063] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-94061] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-94058] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-94059] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-94060] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-105883] Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incor…

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-104392] Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-ne…

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-105318] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-105870] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-105872] Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce pr…

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad alta de autorización en TMS Amelia ameliabooking permite eludir controles de acceso

Una vulnerabilidad de autorización faltante (CVE-2026-96461, CVSS 7.5) en TMS Amelia ameliabooking versiones hasta 2.4.10 permite a atacantes eludir controles de acceso mediante configuración incorrecta de niveles de seguridad. Esta falla afecta principalmente a plataformas de reservas y gestión de citas en sectores turismo, salud y servicios en LATAM, exponiendo datos sensibles de clientes y operaciones altas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad XSS en FiboSearch para WooCommerce permite inyección de código malicioso

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el plugin FiboSearch (ajax-search-for-woocommerce) versión 1.34.1 y anteriores, utilizado en tiendas en línea basadas en WordPress. Un atacante podría inyectar código JavaScript malicioso a través de parámetros de búsqueda, comprometiendo sesiones de clientes y administradores en México y Latinoamérica. Esta vulnerabilidad afecta directamente a comercios electrónicos que dependen de este plugin para funcionalidad de búsqueda.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad XSS alta en Basix NEX-Forms afecta formularios WordPress

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Basix NEX-Forms versión 9.3.1 y anteriores, que permite inyectar código malicioso a través de formularios en WordPress. Esta falla afecta principalmente a sitios web en LATAM que utilizan este complemento popular para captura de datos y formularios de contacto. Un atacante podría comprometer sesiones de usuarios administrativos y robar información sensible de visitantes.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad XSS Reflejado en Welcart e-Commerce permite inyección de código en navegadores

Welcart e-Commerce (versiones hasta 2.12.3) contiene una falla de neutralización de entrada que permite ataques XSS reflejados. Un atacante puede inyectar código malicioso que se ejecuta en el navegador de clientes al acceder a URLs manipuladas. Esto afecta principalmente a tiendas en línea en México y Latinoamérica que usan esta plataforma, exponiendo datos de sesión y credenciales de usuarios.

nvdaltovulnerabilidad CVSS 7.1 NVD