Vulnerabilidades exploradas (CISA KEV)

CVE-2026-9082 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-89 20/05/2026

Drupal Core SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

CVE-2025-54236 Crítica · 9.1 KEV Urgente · 83 Exploit público CWE-20 09/09/2025

Adobe Commerce and Magento Improper Input Validation Vulnerability

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

CVE-2025-54068 Crítica · 9.8 KEV Urgente · 70 Exploit público CWE-94 17/07/2025

Laravel Livewire Code Injection Vulnerability

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.

CVE-2025-49113 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-502 02/06/2025

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVE-2025-35939 Média · 5.3 KEV Alta · 52 CWE-472 07/05/2025

Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.

CVE-2025-32432 Crítica · 10.0 KEV Urgente · 83 Exploit público CWE-94 25/04/2025

Craft CMS Code Injection Vulnerability

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.

CVE-2024-58136 Crítica · 9.8 KEV Alta · 64 Exploit público CWE-424 10/04/2025

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

CVE-2025-23209 Alta · 8.1 KEV Alta · 56 CWE-94 17/01/2025

Craft CMS Code Injection Vulnerability

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

CVE-2024-56145 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 18/12/2024

Craft CMS Code Injection Vulnerability

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

CVE-2024-34102 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-611 13/06/2024

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVE-2022-24086 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-20 16/02/2022

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CVE-2021-32648 Crítica · 9.1 KEV Urgente · 73 Exploit público CWE-287 26/08/2021

October CMS Improper Authentication

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

CVE-2021-21311 Alta · 7.2 KEV Alta · 69 Exploit público CWE-918 11/02/2021

Adminer Server-Side Request Forgery Vulnerability

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

CVE-2020-36193 Alta · 7.5 KEV Alta · 59 CWE-22 18/01/2021

PEAR Archive_Tar Improper Link Resolution Vulnerability

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

CVE-2021-3129 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware 12/01/2021

Laravel Ignition File Upload Vulnerability

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

CVE-2020-13671 Alta · 8.8 KEV Alta · 62 Exploit público CWE-434 20/11/2020

Drupal core Un-restricted Upload of File

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

CVE-2020-28949 Alta · 7.8 KEV Alta · 68 Exploit público 19/11/2020

PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CVE-2020-11023 Média · 6.1 KEV Alta · 67 Exploit público CWE-79 29/04/2020

JQuery Cross-Site Scripting (XSS) Vulnerability

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-6340 Alta · 8.1 KEV Urgente · 76 Exploit público CWE-502 21/02/2019

Drupal Core Remote Code Execution Vulnerability

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

CVE-2018-7600 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-20 29/03/2018

Drupal Core Remote Code Execution Vulnerability

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

CVE-2017-9841 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-94 27/06/2017

PHPUnit Command Injection Vulnerability

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

CVE-2016-10033 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-88 30/12/2016

PHPMailer Command Injection Vulnerability

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.