Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas3017▼ 66 respecto a la semana anterior
Críticas / altas1412▲ 56 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)381▼ 129 respecto a la semana anterior
7 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Media (6.1) | 0.24% | — | HikashopAIJoomlaAI | 20/7/2026 | 23/7/2026 | Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect. | |
| Aplazada | Media (5.1) | 0.23% | — | Joomla HikashopAI | 9/4/2026 | 26/9/2026 | Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or… | |
| Analizada | Media (6.5) | 0.16% | — | Hikashop | 15/3/2025 | 17/6/2026 | A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions. | |
| Analizada | Alta (7.2) | 0.51% | — | Hikashop | 25/2/2025 | 17/6/2026 | A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend. | |
| Modificada | Media (5.4) | 0.28% | — | Hikashop | 21/10/2024 | 17/6/2026 | A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description `parameter is not sanitised in the backend. | |
| Modificada | Crítica (9.8) | 0.64% | — | Hikashop | 7/8/2023 | 17/6/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection. | |
| Modificada | Media (4.8) | 0.54% | — | Hikashop | 9/3/2020 | 17/6/2026 | HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption]. |