Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2811▼ 173 respecto a la semana anterior

Críticas / altas1356▲ 48 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)267▼ 256 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-12936	Aplazada	Media (4.9)	0.44%	—	Recurio^AI	8/7/2026	8/7/2026	The Recurio – Ultimate Subscription for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…
CVE-2026-32989	Analizada	Alta (8.6)	0.30%	—	Precurio Intranet Portal	20/3/2026	17/6/2026	Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this to upload executable files to web-accessible locations, leading to arbitrary…
CVE-2018-25168	Aplazada	Media (5.3)	0.22%	—	Precurio Intranet Portal^AI	6/3/2026	17/6/2026	Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameters to add new admin…
CVE-2016-10759	Modificada	Crítica (9.8)	3.7%	—	Precurio	24/5/2019	17/6/2026	The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads.