Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2005-2082

Publication date:
05/07/2005
im_trbbs.cgi in imTRSET 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the df parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2084

Publication date:
05/07/2005
Cross-site scripting (XSS) vulnerability in SearchResults.aspx in Community Forum allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2085

Publication date:
05/07/2005
Buffer overflow in Inframail Advantage Server Edition 6.0 through 6.7 allows remote attackers to cause a denial of service (process crash) via a long (1) SMTP FROM field or possibly (2) FTP NLST command.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2086

Publication date:
05/07/2005
PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2106

Publication date:
05/07/2005
Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2107

Publication date:
05/07/2005
Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p or (2) comment parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2108

Publication date:
05/07/2005
SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2109

Publication date:
05/07/2005
wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2111

Publication date:
05/07/2005
login.cgi in Community Link Pro Web Editor allows remote attackers to execute arbitrary commands via the file parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2112

Publication date:
05/07/2005
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter to edit.php or (2) cid parameter to comment_edit.php.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2113

Publication date:
05/07/2005
SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via crafted values in an XML file, as demonstrated using the blogger.getPost method.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025

CVE-2005-2115

Publication date:
05/07/2005
Soldier of Fortune II 1.02x and 1.03 allows remote attackers to cause a denial of service (server crash) via a large ID value in the ignore command, which is used as an array index and causes an out-of-bounds operation.
Severity CVSS v4.0: Pending analysis
Last modification:
03/04/2025