Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/08/2026

[CVE-2026-15361] The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJA…

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19062] A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. …

A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Ther…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-66447] Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.

Unauthenticated SQL Injection in WordPress File Upload

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65569] Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.

Subscriber SQL Injection in WP Job Portal

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65546] Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

Unauthenticated SQL Injection in Qode Tours

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65547] Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.

Subscriber SQL Injection in Creative Mail

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65520] Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

Unauthenticated SQL Injection in WP OAuth Server

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65508] Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

Unauthenticated SQL Injection in Simply Schedule Appointments

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-34191] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-5134] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

06/08/2026

Inyección SQL alta en SourceCodester Computer Repair Shop Management System 1.0

Se detectó una vulnerabilidad de inyección SQL en SourceCodester Computer Repair Shop Management System versión 1.0, específicamente en el archivo /classes/Master.php?f=delete_product mediante manipulación del parámetro ID. El exploit ha sido divulgado públicamente, permitiendo ataques remotos sin autenticación. Afecta principalmente a talleres de reparación y empresas de servicios técnicos en México y LATAM que utilicen este sistema para gestionar inventario de productos.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-12713] The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a para…

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18970] A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617.…

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclos…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18958] A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79…

A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit is n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71287] Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names usin…

Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace('/[^a-zA-Z0-9_().]/', '', $column)`. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as `SLEEP(5)` passes through completely unmodified. The sanitized value is…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71288] Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for…

Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: `my @order_by = $input->multi_param('order_by'); foreach my $order (@order_by) { my $value = $input->param($order . "_ovalue"); $query_orderby = " …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71292] Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.ad…

Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, whitelists the `dir` (ASC/DESC) request parameter via in_array(), but falls back to the raw, attacker-supplied `sort` GET parameter whenever the requested key is not present in the per-controller $_gridSorting whitelist array: `$column = isset($this->_gridSorting[$params['sort']]) ? ... : $…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71276] Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query stri…

Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf() in both the PostgreSQL reader (readers/postgres/messages.go: `fmt.Sprintf("SELECT * FROM %s WHERE %s ...", format, cond)`) and the TimescaleDB reader (readers/timescale/messages.…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad de inyección SQL en Mautic afecta gestión de contactos

Mautic presenta una vulnerabilidad alta (CVSS 7.1) en el controlador AjaxController donde el parámetro 'field' no se valida correctamente antes de ser usado como identificador SQL directo. Un atacante autenticado podría ejecutar consultas SQL arbitrarias para acceder, modificar o exfiltrar datos de contactos (leads) en sistemas que usan esta plataforma de marketing automation, común en empresas medianas y agencias de LATAM.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

05/08/2026

Inyección SQL crítica en Inventory-Management-System-PHP permite bypass de autenticación

El sistema de gestión de inventario PHP contiene vulnerabilidades de inyección SQL en los módulos login.php y delete.php debido a la concatenación insegura de parámetros POST sin validación ni uso de consultas parametrizadas. Un atacante puede ejecutar consultas arbitrarias, eludir la autenticación y manipular datos de inventario críticos en sistemas empresariales de LATAM que dependen de este software.

nvdcriticovulnerabilidad CVSS 9.8 NVD