Alertas de Seguridad de la Información

M Crítico vulnerabilidad

16/08/2026

Vulnerabilidad crítica en plugin ProSolution WP Client permite eliminación arbitraria de archivos

El plugin ProSolution WP Client para WordPress (versiones ≤2.0.8) contiene una falla de validación de rutas que permite a atacantes no autenticados eliminar archivos arbitrarios del servidor. Esta vulnerabilidad puede ser explotada para ejecutar código remoto eliminando archivos críticos de WordPress, comprometiendo completamente el sitio web. Afecta directamente a pequeñas y medianas empresas en LATAM que utilizan este plugin en plataformas de comercio electrónico y gestión de contenidos.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad de Scripting Almacenado en plugin Platnosci Online Blue Media (Autopay) para WordPress

El plugin Platnosci Online Blue Media (Autopay) para WordPress, versiones hasta 5.0.0, es vulnerable a Cross-Site Scripting (XSS) almacenado a través del parámetro POST 'bm_woocommerce_css_editor_content'. La falla reside en el método Css_Editor::handle_save() que carece de validación de capacidades, verificación de nonce y sanitización de entrada, permitiendo a atacantes inyectar código malicioso sin autenticación. Este vector impacta tiendas de comercio electrónico en LATAM que dependen de WooCommerce para procesar pagos y gestionar inventario.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/08/2026

Inyección SQL alta en Evergreen afecta componente OpenSRF Gateway

Se ha identificado una vulnerabilidad de inyección SQL (CVSS 7.3) en Evergreen versiones hasta 3.14.11, 3.15.11, 3.16.5 y 3.17-beta1. La falla reside en la función desconocida del archivo /osrf-gateway-v1 del servicio open-ils.fielder, permitiendo manipulación remota sin autenticación. Bibliotecas digitales, sistemas de gestión documental y plataformas educativas en LATAM que usan Evergreen están expuestas a exfiltración de datos sensibles.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

16/08/2026

[CVE-2026-19924] A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability…

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-19919] A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown funct…

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73052] SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them d…

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73053] SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji func…

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-73054] SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoi…

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream includin…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73042] SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing…

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73043] SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculat…

SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in the desktop client renderer with Node integration enabled, allowing arbitrary code execution when the …

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73044] SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored …

SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewColWidth API that break out of style attributes and inject event handlers on every table cell, executing arbitrary code in the Electron renderer with Node integration enabled.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-73045] SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerabil…

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73046] SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middl…

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This all…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73050] SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select op…

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73041] SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the se…

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-18855] The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f…

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). E…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-19905] A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHS…

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-19901] A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown functi…

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-19598] The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalatio…

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON met…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-19900] A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown …

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was c…

nvdaltovulnerabilidad CVSS 8.1 NVD