Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2532▼ 363 respecto a la semana anterior

Críticas / altas1340▲ 76 respecto a la semana anterior

Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-69070	Aplazada	Alta (8.1)	0.58%	—	Ancorathemes Tornados^AI	22/1/2026	17/6/2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tornados tornados allows PHP Local File Inclusion.This issue affects Tornados: from n/a through <= 2.1.
CVE-2020-10257	Modificada	Crítica (9.8)	8.9%	—	Themerex Addons Themerex Ozeum-museum Themerex Chit Club-board Games Themerex Yottis-simple Portfolio+59	10/3/2020	17/6/2026	The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
CVE-2010-1328	Modificada	Media (4.3)	1.1%	—	Tornadostore	6/7/2010	16/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tipo or (2) destino parameter to login_registrese.php3 in the Services section, (3) the rubro parameter to precios.php3 in the Products section, (4) the arti…
CVE-2010-1327	Modificada	Alta (7.5)	0.96%	—	Tornadostore	6/7/2010	16/6/2026	Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the marca parameter to precios.php3 or (2) the where parameter in a delivery_courier action to control/abm_list.php3.