Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2663▼ 380 respecto a la semana anterior

Críticas / altas1289▼ 36 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)244▼ 274 respecto a la semana anterior

5 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-63807	Analizada	Crítica (9.8)	0.49%	—	2dogz Blogin	20/11/2025	17/6/2026	An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without authentication. Successful…
CVE-2025-32169	Aplazada	Media (6.5)	0.40%	—	Suresh Prasad Showeblogin Showeblogin Social^AI	4/4/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh Prasad Showeblogin Social showeblogin-facebook-page-like-box allows DOM-Based XSS.This issue affects Showeblogin Social: from n/a through <= 7.0.
CVE-2024-7862	Analizada	Media (6.5)	0.20%	—	Kimhuebel Blogintroduction-wordpress-plugin	12/9/2024	17/6/2026	The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2009-1050	Modificada	Alta (7.5)	2.9%	—	Kamads Bloginator	24/3/2009	16/6/2026	Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYourself cookie.
CVE-2009-1049	Modificada	Alta (7.5)	1.4%	—	Kamads Bloginator	24/3/2009	16/6/2026	SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL commands via the id parameter.