Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-60511

Publication date:

21/10/2025

Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter in /blocks/openai_chat/api/completion.php. An authenticated student can impersonate another user&#39;s block (e.g., administrator) and send queries that are executed with that block&#39;s configuration. This can expose administrator-only Source of Truth entries, alter model behavior, and potentially misuse API resources.

Severity CVSS v4.0: Pending analysis

Last modification:

21/10/2025

CVE-2025-60772

Publication date:

21/10/2025

Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges and lock out the legitimate administrator via crafted HTTP requests.

Severity CVSS v4.0: Pending analysis

Last modification:

22/10/2025

CVE-2025-62518

Publication date:

21/10/2025

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

Severity CVSS v4.0: Pending analysis

Last modification:

21/10/2025

CVE-2025-62595

Publication date:

21/10/2025

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.

Severity CVSS v4.0: Pending analysis

Last modification:

21/10/2025

CVE-2025-62597

Publication date:

21/10/2025

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.

Severity CVSS v4.0: MEDIUM

Last modification:

24/10/2025

CVE-2025-60500

Publication date:

21/10/2025

QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-11534

Publication date:

21/10/2025

The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials.

Severity CVSS v4.0: CRITICAL

Last modification:

21/10/2025

CVE-2025-60280

Publication date:

21/10/2025

Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application&#39;s web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly in the browser. When exploited, an attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the user, or deface the website. This can lead to user data compromise, loss of user trust, and a broader attack surface for more advanced exploitation techniques.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2025

CVE-2025-61181

Publication date:

21/10/2025

daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.

Severity CVSS v4.0: Pending analysis

Last modification:

23/10/2025

CVE-2025-61194

Publication date:

21/10/2025

daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.

Severity CVSS v4.0: Pending analysis

Last modification:

23/10/2025

CVE-2025-60751

Publication date:

21/10/2025

GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2025-61220

Publication date:

21/10/2025

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

Subscribe to Vulnerabilities