Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-53515
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that allows for SQL injection <br /> and remote code execution through NetworkServlet.archiveTrap(). This <br /> issue requires an authenticated attacker with at least user-level <br /> privileges. Certain input parameters are not sanitized, allowing an <br /> attacker to perform SQL injection and potentially execute code in the <br /> context of the &amp;#39;nt authority\local service&amp;#39; account.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-53519
Publication date:
11/07/2025
A vulnerability exists in Advantech iView versions prior to 5.7.05 build<br /> 7057, which could allow a reflected cross-site scripting (XSS) attack. <br /> By manipulating specific parameters, an attacker could execute <br /> unauthorized scripts in the user&amp;#39;s browser, potentially leading to <br /> information disclosure or other malicious activities.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-53475
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that could allow for SQL <br /> injection and remote code execution through <br /> NetworkServlet.getNextTrapPage(). This issue requires an authenticated <br /> attacker with at least user-level privileges. Certain parameters in this<br /> function are not properly sanitized, allowing an attacker to perform <br /> SQL injection and potentially execute code in the context of the &amp;#39;nt <br /> authority\local service&amp;#39; account.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-50109
Publication date:
11/07/2025
Emerson ValveLink Products store<br /> sensitive information in cleartext within a resource that might be accessible to another control sphere.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-52459
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that allows for argument <br /> injection in NetworkServlet.backupDatabase(). This issue requires an <br /> authenticated attacker with at least user-level privileges. Certain <br /> parameters can be used directly in a command without proper <br /> sanitization, allowing arbitrary arguments to be injected. This can <br /> result in information disclosure, including sensitive database <br /> credentials.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-52579
Publication date:
11/07/2025
Emerson ValveLink Products store sensitive information in cleartext in memory. The <br /> sensitive memory might be saved to disk, stored in a core dump, or <br /> remain uncleared if the product crashes, or if the programmer does not <br /> properly clear the memory before freeing it.
Severity CVSS v4.0: CRITICAL
Last modification:
11/07/2025

CVE-2025-53397
Publication date:
11/07/2025
A vulnerability exists in Advantech iView versions prior to 5.7.05 build<br /> 7057, which could allow a reflected cross-site scripting (XSS) attack. <br /> By exploiting this flaw, an attacker could execute unauthorized scripts <br /> in the user&amp;#39;s browser, potentially leading to information disclosure or <br /> other malicious activities.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-53471
Publication date:
11/07/2025
Emerson ValveLink products <br /> receive input or data, but it do not validate or incorrectly <br /> validates that the input has the properties that are required to process<br /> the data safely and correctly.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-52577
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that could allow SQL injection<br /> and remote code execution through NetworkServlet.archiveTrapRange(). <br /> This issue requires an authenticated attacker with at least user-level <br /> privileges. Certain input parameters are not properly sanitized, <br /> allowing an attacker to perform SQL injection and potentially execute <br /> code in the context of the &amp;#39;nt authority\local service&amp;#39; account.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-46358
Publication date:
11/07/2025
Emerson ValveLink products <br /> do not use or incorrectly uses a protection mechanism that provides <br /> sufficient defense against directed attacks against the product.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-48496
Publication date:
11/07/2025
Emerson ValveLink products <br /> use a fixed or controlled search path to find resources, but one or <br /> more locations in that path can be under the control of unintended <br /> actors.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-46704
Publication date:
11/07/2025
A vulnerability exists in Advantech iView in <br /> NetworkServlet.processImportRequest() that could allow for a directory <br /> traversal attack. This issue requires an authenticated attacker with at <br /> least user-level privileges. A specific parameter is not properly <br /> sanitized or normalized, potentially allowing an attacker to determine <br /> the existence of arbitrary files on the server.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025
Subscribe to Vulnerabilities