Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas3027▼ 69 respecto a la semana anterior

Críticas / altas1424▲ 58 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)382▼ 128 respecto a la semana anterior

14 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-39433	Aplazada	Alta (7.1)	0.15%	—	Beke RO Bknewsticker^AI	17/4/2025	17/6/2026	Cross-Site Request Forgery (CSRF) vulnerability in beke_ro Bknewsticker bknewsticker allows Stored XSS.This issue affects Bknewsticker: from n/a through <= 1.0.5.
CVE-2024-13630	Analizada	Media (6.1)	0.60%	—	Mahinsha Newsticker	26/2/2025	17/6/2026	The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2023-41450	Modificada	Alta (8.8)	1.2%	—	Phpkobo Ajaxnewsticker	28/9/2023	9/7/2026	An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.
CVE-2023-41447	Modificada	Media (6.1)	0.66%	—	Phpkobo Ajaxnewsticker	28/9/2023	9/7/2026	Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the subcmd parameter in the index.php component.
CVE-2023-41446	Modificada	Media (6.1)	0.66%	—	Phpkobo Ajaxnewsticker	28/9/2023	9/7/2026	Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script to the title parameter in the index.php component.
CVE-2023-41453	Modificada	Media (6.1)	0.66%	—	Phpkobo Ajaxnewsticker	27/9/2023	9/7/2026	Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the cmd parameter in the index.php component.
CVE-2023-41452	Modificada	Alta (8.8)	0.54%	—	Phpkobo Ajaxnewsticker	27/9/2023	9/7/2026	Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
CVE-2023-41451	Modificada	Media (6.1)	0.66%	—	Phpkobo Ajaxnewsticker	27/9/2023	9/7/2026	Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.
CVE-2023-41449	Modificada	Crítica (9.8)	1.4%	—	Phpkobo Ajaxnewsticker	27/9/2023	9/7/2026	An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.
CVE-2023-41448	Modificada	Media (6.1)	0.70%	—	Phpkobo Ajaxnewsticker	27/9/2023	9/7/2026	Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the ID parameter in the index.php component.
CVE-2023-41445	Modificada	Media (6.1)	0.61%	—	Phpkobo Ajaxnewsticker	27/9/2023	9/7/2026	Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the index.php component.
CVE-2009-4709	Modificada	Alta (7.5)	1.0%	—	Dirk Maiwert Datamints Newsticker	15/3/2010	16/6/2026	SQL injection vulnerability in the datamints Newsticker (datamints_newsticker) extension before 0.7.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2003-0206	Modificada	Media (5)	1.3%	—	Gkrellm Newsticker	12/5/2003	16/6/2026	gkrellm-newsticker gkrellm plugin before 0.3-3.1 allows remote attackers to cause a denial of service (crash) via (1) link or (2) title elements that contain multiple lines.
CVE-2003-0205	Modificada	Alta (7.5)	1.9%	—	Gkrellm Newsticker	12/5/2003	16/6/2026	gkrellm-newsticker gkrellm plugin before 0.3-3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the ticker title of a URI.