Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100641] SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it int…

SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content such as becomes an executable event-handler attribute. Because the SiYua…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100642] SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the …

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative a…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100643] SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea …

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute stored JavaScript when other users open affected database menus, and in the Electron desktop app with …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100644] SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the da…

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100645] SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery an…

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls Node.js child_process APIs to execute arbitrary commands with user privileges.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100636] SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoi…

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100637] SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint th…

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100639] SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (…

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing a Kramdown inline attribute list (IAL). Because the shared Lute renderer parses Kramdown IAL from text/plain input, an attacker-supplied Markdown snippet…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100623] Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase Pos…

Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization (public.check_min_rights('admin', ...)); they do not require a pending invitation in tmp_users, acceptance of an invite …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100625] Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/…

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken from /build/upload/:jobId/* to the builder service while injecting Capgo's privil…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100615] Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowin…

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100617] Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the org…

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100610] Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history withou…

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selected solely by an attacker-supplied chatflowid, and patchDeleteUpsertHistory() deletes rows by an attacker-supplied array of record UUIDs. As a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100612] Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.…

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_map…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100607] Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider…

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local passw…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100315] A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c…

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

Inyección SQL alta en CloudClassroom-PHP-Project afecta plataformas educativas

Se ha identificado una vulnerabilidad de inyección SQL en CloudClassroom-PHP-Project (hasta versión 5dadec098bfbbf3300d60c3494db3fb95b66e7be) que permite manipular el parámetro 'eno' en el archivo updatedetailsfromstudent.php. El ataque es remotamente explotable y el exploit ha sido divulgado públicamente. Instituciones educativas y plataformas de aprendizaje en LATAM que usen este software están en riesgo inmediato de comprometimiento de bases de datos estudiantiles.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-96532] The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership ch…

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

26/09/2026

Vulnerabilidad crítica de carga arbitraria de archivos en plugin Request a Quote for WooCommerce

El plugin Request a Quote for WooCommerce para WordPress es vulnerable a carga arbitraria de archivos en versiones hasta la 2.9.2 debido a validación insuficiente de extensiones y tipos MIME en la función afrfq_submit_quote_via_popup(). Un atacante puede cargar archivos maliciosos (como shells PHP) directamente al servidor sin restricción, comprometiendo completamente sitios de comercio electrónico en LATAM. Con CVSS 9.8, afecta principalmente a pequeñas y medianas empresas que usan este plugin para gestionar cotizaciones de productos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-84095] The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one …

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.

nvdaltovulnerabilidad CVSS 8.0 NVD