Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2614▼ 473 respecto a la semana anterior

Críticas / altas1270▼ 74 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)243▼ 274 respecto a la semana anterior

17 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2020-37225	Aplazada	Media (5.1)	0.24%	—	Powie Whois Domain Check^AI	13/5/2026	17/6/2026	Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php…
CVE-2025-30638	Aplazada	Media (5.9)	0.25%	—	Powiet Powies Uptime Robot^AI	6/6/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's Uptime Robot powies-uptime-robot allows Stored XSS.This issue affects Powie's Uptime Robot: from n/a through <= 0.9.7.
CVE-2025-23641	Aplazada	Media (6.5)	0.35%	—	Powieit Powies Plinks Pagepeeker^AI	16/1/2025	17/6/2026	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's pLinks PagePeeker plinks allows DOM-Based XSS.This issue affects Powie's pLinks PagePeeker: from n/a through <= 1.0.2.
CVE-2012-6524	Modificada	Alta (7.5)	1.1%	—	Powie PGB	31/1/2013	16/6/2026	SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-1211	Modificada	Media (4.3)	1.5%	—	Powie Pfile	24/2/2012	16/6/2026	Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter.
CVE-2012-1210	Modificada	Alta (7.5)	1.0%	—	Powie Pfile	24/2/2012	16/6/2026	SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-5269	Modificada	Alta (7.5)	1.00%	—	Powie Psys	28/11/2008	16/6/2026	SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands via the shownews parameter.
CVE-2008-4357	Modificada	Alta (7.5)	1.00%	—	Powie Plink	30/9/2008	16/6/2026	SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-4355	Modificada	Alta (7.5)	1.0%	—	Powie Pforum	30/9/2008	16/6/2026	SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-4347	Modificada	Alta (7.5)	1.00%	—	Powie Pnews	30/9/2008	16/6/2026	SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
CVE-2008-3131	Modificada	Media (6.8)	0.91%	—	Powie Psys	10/7/2008	16/6/2026	SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the showid parameter.
CVE-2008-2673	Modificada	Alta (7.5)	1.0%	—	Powie Pnews	12/6/2008	16/6/2026	SQL injection vulnerability in index.php in Powie pNews 2.08 and 2.10, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the shownews parameter.
CVE-2006-6038	Modificada	Alta (7.5)	1.2%	—	Powie Pforum	22/11/2006	16/6/2026	SQL injection vulnerability in editpoll.php in Powie's PHP Forum (pForum) 1.29a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-6039	Modificada	Alta (7.5)	1.3%	—	Powie PHP Matchmaker	22/11/2006	16/6/2026	SQL injection vulnerability in matchdetail.php in Powie's PHP MatchMaker 4.05 and earlier allows remote attackers to execute arbitrary SQL commands via the edit parameter.
CVE-2004-1716	Modificada	Media (6.8)	2.4%	—	Powie Pforum	16/8/2004	16/6/2026	Cross-site scripting (XSS) vulnerability in PForum before 1.26 allows remote attackers to inject arbitrary web script or HTML via the (1) IRC Server or (2) AIM ID fields in the user profile.
CVE-2002-0319	Modificada	Alta (7.5)	7.2%	—	Powie Pforum	25/6/2002	16/6/2026	Cross-site scripting vulnerability in edituser.php for pforum 1.14 and earlier allows remote attackers to execute script and steal cookies from other users via Javascript in a username.
CVE-2002-0287	Modificada	Alta (10)	2.4%	—	Powie Pforum	31/5/2002	16/6/2026	pforum 1.14 and earlier does not explicitly enable PHP magic quotes, which allows remote attackers to bypass authentication and gain administrator privileges via an SQL injection attack when the PHP server is not configured to use magic quotes by default.