Alta
CVE-2026-47740
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 620
Restablecer filtros
Alta
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Media
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Media
CVE-2026-45580
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
Alta
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
Alta
CVE-2026-41147
NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class
Alta
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
Alta
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Alta
CVE-2026-40597
MantisBT has a Content Security Policy bypass via attachments
Alta
CVE-2026-40596
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
Media
CVE-2026-44737
Grav: Stored XSS via page title (data[header][title]) in admin panel
Crítica
CVE-2026-44212
PrestaShop has a stored XSS executable in customer service view
Media
CVE-2026-42877
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
Baja
CVE-2026-27964
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
Alta
CVE-2026-27891
FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
Crítica
ghsa-gr3r-crp5-qrrm
Compromised tag of intercom-php published via GitHub
Alta
CVE-2026-42845
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
Crítica
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
Media
CVE-2026-45008
phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins
Alta
CVE-2026-46359
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Media
CVE-2026-46361
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
Alta
CVE-2026-46367
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
Media
CVE-2026-43882
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
Alta
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.