Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2726▼ 82 respecto a la semana anterior

Críticas / altas1416▲ 189 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)100▼ 400 respecto a la semana anterior

8 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-89180	Aplazada	Alta (8.7)	0.56%	—	Thinking Software Technology Efence^AI	14/9/2026	18/9/2026	EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVE-2026-80237	Aplazada	Alta (8.7)	0.79%	—	Thinking Software Technology Efence^AI	26/8/2026	26/8/2026	EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVE-2026-80236	Aplazada	Alta (8.8)	0.48%	—	Thinking Software Technology Efence^AI	26/8/2026	26/8/2026	Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.
CVE-2026-80235	Aplazada	Crítica (9.3)	0.90%	—	Thinking Software Technology Efence^AI	26/8/2026	3/9/2026	EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVE-2023-32754	Modificada	Crítica (9.8)	1.0%	—	Thinkingsoftware Efence	16/6/2023	17/6/2026	Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
CVE-2023-22900	Modificada	Crítica (9.8)	1.0%	—	Thinkingsoftware Efence	31/1/2023	17/6/2026	Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
CVE-2014-6659	Modificada	Media (5.4)	0.27%	—	Defence.pk	23/9/2014	17/6/2026	The Defence.pk (aka com.tapatalk.defencepkforums) application 2.4.13.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-4526	Modificada	Media (4.3)	1.6%	—	Efence Project Efence	2/7/2014	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) zoneid, (3) pubKey, or (4) privKey parameter.