Alertas de Seguridad de la Información

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `` attribute. This makes it possible for unauthentica…

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart …

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el plugin Gutenberg Blocks by Kadence Blocks (versiones hasta 3.7.11.1) que permite a atacantes inyectar código malicioso en páginas web generadas. Esta falla afecta sitios WordPress en México y Latinoamérica que utilizan este plugin para diseño de contenidos, exponiendo datos de usuarios y comprometiendo la integridad de los sitios. Con puntuación CVSS 7.1, constituye una amenaza moderada-alta que requiere atención inmediata.