Alertas de Seguridad de la Información

M Crítico vulnerabilidad

21/09/2026

Vulnerabilidad crítica de desbordamiento de búfer en Netcore NBR200V2 (CVE-2026-94100)

Se identificó una debilidad crítica (CVSS 9.9) en el enrutador Netcore NBR200V2 versión 1.3.241127.071246 que afecta la función wan_config_set_vlan del componente de reconfiguración VLAN WAN. Un atacante remoto puede manipular el parámetro vlan_wanX.ports para provocar un desbordamiento de búfer y potencialmente ejecutar código arbitrario. El exploit está disponible públicamente, aumentando significativamente el riesgo para dispositivos expuestos en redes corporativas e ISPs de la región.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-94098] A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unk…

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this di…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-94099] A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some u…

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERY_STRING results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was c…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-94095] A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability…

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacte…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-94096] A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unkn…

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this d…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-94097] A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part o…

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about t…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

20/09/2026

[CVE-2026-94089] A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of…

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-94044] A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb235…

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-94038] A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textS…

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c612…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-94039] A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoic…

A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-94036] A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. Th…

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-94015] A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unk…

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

20/09/2026

[CVE-2026-90817] An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing a…

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/09/2026

Vulnerabilidad alta de inyección de comandos OS en getID3 anterior a 1.9.26

getID3 versiones anteriores a 1.9.26 contiene una vulnerabilidad de inyección de comandos del sistema operativo en manejadores shell que no escapan correctamente nombres de archivo en cadenas de comando. Atacantes pueden crear nombres de archivo maliciosos con metacaracteres de shell para inyectar comandos arbitrarios ejecutados con los privilegios del proceso que integra getID3. Esta vulnerabilidad afecta principalmente a servidores web y aplicaciones de procesamiento de multimedia en empresas de LATAM que utilizan librerías PHP desactualizadas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/09/2026

Vulnerabilidad alta en NivoCart: tokens de restablecimiento predecibles permiten acceso administrativo

NivoCart versiones hasta 2.4.0 contiene una vulnerabilidad de severidad alta (CVSS 8.1) en el endpoint forgotten.php que genera tokens de recuperación predecibles usando substr(md5(mt_rand()), 0, 10). Un atacante que conozca el correo de un administrador puede solicitar un restablecimiento de contraseña, predecir el token y obtener acceso administrativo sin limitaciones de tasa ni expiración. Esta vulnerabilidad afecta directamente a plataformas de e-commerce en México y LATAM que utilizan NivoCart para gestionar tiendas en línea.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/09/2026

Inyección SQL alta en SourceCodester Drug Recommendation System 1.0

Se ha identificado una vulnerabilidad de inyección SQL (CVSS 7.3) en SourceCodester Drug Recommendation System 1.0 a través del parámetro ID en /Admin/edit_symptom.php. La vulnerabilidad permite a atacantes remotos ejecutar comandos SQL arbitrarios y comprometer bases de datos de sistemas de salud. El exploit está disponible públicamente, incrementando significativamente el riesgo en instituciones médicas y farmacias en LATAM que utilicen este software.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

20/09/2026

Vulnerabilidad crítica de desbordamiento de búfer en Comfast CF-N1-S 2.6.0.1

Se ha identificado una vulnerabilidad crítica (CVSS 10.0) en los routers Comfast CF-N1-S versión 2.6.0.1 que afecta la interfaz web de gestión. Un desbordamiento de búfer en la función get_css_path_from_uri del archivo /cgi-bin/mbox-config permite a atacantes remotos ejecutar código arbitrario sin autenticación. La vulnerabilidad ha sido divulgada públicamente y explotada activamente.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

20/09/2026

Vulnerabilidad alta de inyección de código en DedeCMS hasta versión 5.7.118

Se identificó una vulnerabilidad de inyección de código en DedeCMS versiones hasta 5.7.118, localizada en el archivo plus/mytag_js.php que permite manipulación remota del parámetro 'aid'. El exploit está públicamente disponible y representa un riesgo inmediato para sitios web y portales de contenido en México y Latinoamérica que utilizan este CMS. La vulnerabilidad permite ejecución de código arbitrario con impacto alta en la integridad y disponibilidad de aplicaciones web.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/09/2026

Vulnerabilidad alta de carga arbitraria de archivos en NivoCart hasta versión 2.4.0

NivoCart versiones 2.4.0 y anteriores contienen una vulnerabilidad de carga arbitraria de archivos en el endpoint File Manager multi() que permite a atacantes con acceso de solo lectura al back-office subir archivos PHP a directorios web accesibles (image/data/) y ejecutar código remoto. La validación de extensiones de archivo falla cuando el parámetro chunks es 2 o superior. Afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan este carrito de compras para e-commerce.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/09/2026

Inyección SQL alta en Internship Management System 1.0 afecta portales de gestión de pasantías

Se ha identificado una vulnerabilidad de inyección SQL (CVSS 7.3) en el archivo /employer/login.php del sistema de gestión de pasantías versión 1.0, permitiendo a atacantes remotos manipular credenciales y acceder a bases de datos de empresas. El exploit público incrementa el riesgo para instituciones educativas y corporativos en LATAM que utilizan este software para administrar programas de internados.

nvdaltovulnerabilidad CVSS 7.3 NVD