Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Php" — 386 resultados ✕ Limpiar búsqueda
26,305
Total alertas
5286
Críticas
20147
Altas
8
Ransomware
1735
Esta semana
RSS
30 días × Limpiar todo ×
M Alto vulnerabilidad
12/10/2026
Inyección SQL alta en EmployeeRecruitmentSystem afecta portales de reclutamiento
Se identificó una vulnerabilidad de inyección SQL (CVSS 7.3) en EmployeeRecruitmentSystem que permite manipulación remota del componente Registration Handler mediante el archivo adminregister.php. El exploit está disponible públicamente, poniendo en riesgo sistemas de gestión de personal y bases de datos de candidatos en empresas de LATAM que utilicen esta solución.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
12/10/2026
[CVE-2026-108805] A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae35…
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Con…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
12/10/2026
[CVE-2026-108806] A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36…
A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public an…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
12/10/2026
[CVE-2026-108799] A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacte…
A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicl…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-108963] databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., maria…
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly.…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/10/2026
[CVE-2026-108905] pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool…
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/10/2026
Inyección SQL alta en Xinhu Rainrock RockOA permite ejecución remota de código
Se ha identificado una vulnerabilidad de inyección SQL en Xinhu Rainrock RockOA versiones hasta 2.7.6 en el componente Openkqj Action (archivo openkqjAction.php). Un atacante remoto puede manipular el parámetro ID para ejecutar comandos SQL arbitrarios en la base de datos del sistema. El exploit está disponible públicamente, aumentando el riesgo inmediato para empresas en LATAM que usan esta plataforma de gestión documental.
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
11/10/2026
[CVE-2026-104028] The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce ver…
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-78533] Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Unauthenticated PHP Object Injection in Qwery
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-78535] Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
Unauthenticated PHP Object Injection in Photolia
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-81797] Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 …
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-66567] Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
Unauthenticated PHP Object Injection in Anesta
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-66568] Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Unauthenticated PHP Object Injection in Original
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-66569] Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Unauthenticated PHP Object Injection in Kicker
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-78529] Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Unauthenticated PHP Object Injection in Alliance
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-78531] Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Unauthenticated PHP Object Injection in Jacqueline
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-66482] Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Unauthenticated PHP Object Injection in Drone Media
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-66483] Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Unauthenticated PHP Object Injection in Education Center
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-66563] Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Unauthenticated PHP Object Injection in Windsor
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/10/2026
[CVE-2026-66564] Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Unauthenticated PHP Object Injection in ShiftCV
nvdcriticovulnerabilidad CVSS 9.8 NVD