Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas3026▼ 51 respecto a la semana anterior

Críticas / altas1414▲ 60 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)381▼ 129 respecto a la semana anterior

10 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-19354	Aplazada	Media (5.3)	0.32%	—	Lock-upme Opms^AI	9/8/2026	12/8/2026	A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be…
CVE-2018-25420	Aplazada	Alta (8.8)	0.27%	—	Aiopmsd^AI	30/5/2026	22/7/2026	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database information including…
CVE-2018-25419	Aplazada	Alta (8.8)	0.27%	—	Aiopmsd^AI	30/5/2026	22/7/2026	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the genre parameter. Attackers can send GET requests to genre.php with crafted SQL payloads in the genre parameter to extract sensitive database…
CVE-2018-25418	Aplazada	Alta (8.8)	0.28%	—	Aiopmsd^AI	30/5/2026	22/7/2026	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the year parameter. Attackers can send GET requests to year.php with crafted SQL payloads in the year parameter to extract sensitive database…
CVE-2018-25417	Aplazada	Alta (8.8)	0.27%	—	Aiopmsd^AI	30/5/2026	22/7/2026	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the quality parameter. Attackers can send GET requests to quality.php with crafted SQL payloads in the quality parameter to extract sensitive database…
CVE-2018-25416	Aplazada	Alta (8.8)	0.27%	—	Aiopmsd^AI	30/5/2026	22/7/2026	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the country parameter. Attackers can send GET requests to country.php with crafted SQL payloads in the country parameter to extract sensitive database…
CVE-2018-25415	Aplazada	Alta (8.8)	0.27%	—	Aiopms Database Software^AI	30/5/2026	22/7/2026	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the director parameter. Attackers can send GET requests to director.php with crafted SQL payloads in the director parameter to extract sensitive…
CVE-2018-25414	Aplazada	Alta (8.8)	0.27%	—	Aiopmsd^AI	30/5/2026	22/7/2026	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the actor parameter. Attackers can send GET requests to actor.php with crafted SQL payloads in the actor parameter to extract sensitive database…
CVE-2025-50857	Aplazada	Crítica (9.8)	2.3%	—	Zentaopms^AI	26/2/2026	17/6/2026	ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload
CVE-2020-20595	Modificada	Media (6.5)	0.46%	—	Opms Project Opms	22/12/2021	17/6/2026	A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add.