PatchFirst · Vulnerabilidades recientes
Vulnerabilidades publicadas para PHP en los últimos 30 días: 222. Incluidas en el catálogo KEV: 2.
Avisos recientes de vulnerabilidades procedentes de anuncios de fabricantes y noticias de seguridad. Estas alertas no cambian la puntuación de seguridad.
Según OpenNet, PHP tiene una vulnerabilidad de ejecución remota de código (CVE-2026-115560). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.
Qué hacer ahora: Comprueba si hay una actualización de PHP con la corrección e instálala.
CVE-2026-115560
Vulnerabilidades: 7239
Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible sess
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
The course upload preview contained an XSS risk for users uploading unsafe data.
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.
blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has been patched in version 5.1.4.
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.
Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.