Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-47776

Publication date:

15/01/2026

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.

Severity CVSS v4.0: MEDIUM

Last modification:

16/01/2026

CVE-2021-47777

Publication date:

15/01/2026

Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the &#39;eidValue&#39; parameter of the login validation endpoint. Attackers can inject stacked SQL queries using payloads like &#39;;WAITFOR DELAY &#39;0:0:3&#39;-- to manipulate database queries and potentially extract or modify database information.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2021-47781

Publication date:

15/01/2026

Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of service condition through a maliciously crafted .cmd file. Attackers can create a specially constructed .cmd file with repeated characters to overwhelm the console emulator&#39;s buffer and crash the application.

Severity CVSS v4.0: MEDIUM

Last modification:

16/01/2026

CVE-2021-47766

Publication date:

15/01/2026

Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the &#39;tipocomb&#39; parameter of kmaleonW.php that allows attackers to manipulate database queries. Attackers can exploit this vulnerability using boolean-based, error-based, and time-based blind SQL injection techniques to potentially extract or manipulate database information.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2021-47767

Publication date:

15/01/2026

10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute code with system-level permissions.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2021-47768

Publication date:

15/01/2026

ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data or session credentials.

Severity CVSS v4.0: MEDIUM

Last modification:

16/01/2026

CVE-2021-47769

Publication date:

15/01/2026

Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.

Severity CVSS v4.0: MEDIUM

Last modification:

16/01/2026

CVE-2021-47771

Publication date:

15/01/2026

RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the application. Attackers can add oversized entries in Verbindungsname and Server fields to permanently freeze and crash the software, potentially requiring full reinstallation.

Severity CVSS v4.0: MEDIUM

Last modification:

16/01/2026

CVE-2021-47772

Publication date:

15/01/2026

10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2021-47761

Publication date:

15/01/2026

MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can replace the mysqld.exe with a malicious executable, which will execute with system privileges when the computer restarts.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2021-47762

Publication date:

15/01/2026

HTTPDebuggerPro 9.11 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables and gain elevated access to the system.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2021-47763

Publication date:

15/01/2026

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api &#39;sort&#39; parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

Subscribe to Vulnerabilities