Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-32475] Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Usin…

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-73996] Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Unauthenticated Arbitrary File Upload in Masteriyo - LMS

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-66627] Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.

Contributor Arbitrary File Upload in GP Premium

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-32474] Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Contributor Arbitrary File Upload in Templatiq

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-32463] Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

Contributor Arbitrary File Upload in Sync Post With Other Site

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-28192] Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-15748] The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up …

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler th…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-65640] WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file uploa…

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-50768] File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a r…

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-16137] In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credential…

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74845] Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulner…

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

16/08/2026

Vulnerabilidad crítica de carga arbitraria de archivos en plugin ProSolution WP Client para WordPress

El plugin ProSolution WP Client para WordPress (versiones hasta 2.0.10) permite a atacantes cargar archivos arbitrarios explotando validación insuficiente en la función proSol_handleFileUpload. La vulnerabilidad reside en la falta de validación del encabezado Content-Disposition, que puede sobrescribir nombres de archivo permitidos. Con CVSS 9.8, afecta directamente a sitios empresariales, e-commerce y portales de clientes en LATAM que utilicen este plugin.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/08/2026

Ejecución remota de código en plugin Query Wrangler para WordPress (CVE-2026-14498)

El plugin Query Wrangler para WordPress en versiones hasta 1.5.57 permite ejecución remota de código (RCE) a través del parámetro 'options' en el manejador wp_ajax_qw_form_ajax. La vulnerabilidad existe por falta de verificación de capacidades, ausencia de validación de nonce y sanitización deficiente que permite a atacantes reemplazar opciones de consulta y ejecutar funciones arbitrarias. Afecta alta­mente a sitios WordPress en LATAM que utilizan este plugin sin actualizar, poniendo en riesgo datos empresariales y continuidad operativa.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/08/2026

Ejecución remota de código en plugin Templately para WordPress (CVE-2026-18438)

El plugin Templately para WordPress (versiones hasta 3.7.1) es vulnerable a ejecución remota de código a través de la función fetch_remote_file, que valida incorrectamente el tipo de archivo permitiendo inyección de código malicioso. Sitios web en México y LATAM que usan este plugin de plantillas de Elementor/Gutenberg están expuestos a compromisos totales del servidor.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/08/2026

Vulnerabilidad alta de carga arbitraria de archivos en plugin MaxUpload para WordPress

El plugin MaxUpload para WordPress (versiones hasta 1.4.0) contiene una vulnerabilidad de carga arbitraria de archivos (CVSS 8.8) en la función handle_upload. Un atacante puede eludir validaciones de extensión y MIME en el archivo final ensamblado, permitiendo la ejecución de código malicioso en servidores WordPress. Afecta principalmente a sitios en LATAM que usan este plugin para gestionar cargas de archivos grandes sin aplicar validaciones adicionales.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-66271] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-66270] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-49827] WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1…

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chai…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18391] The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unse…

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-15039] The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of i…

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD