Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-13925
Publication date:
17/04/2025
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2025-1525
Publication date:
17/04/2025
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2025-1524
Publication date:
17/04/2025
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2024-11924
Publication date:
17/04/2025
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2025-31339
Publication date:
17/04/2025
An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote authenticated users to craft a malicious file.
Severity CVSS v4.0: MEDIUM
Last modification:
17/04/2025

CVE-2025-31340
Publication date:
17/04/2025
A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.
Severity CVSS v4.0: CRITICAL
Last modification:
17/04/2025

CVE-2025-43715
Publication date:
17/04/2025
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-43717
Publication date:
17/04/2025
In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-31338
Publication date:
17/04/2025
A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user data by accessing the API functionality.
Severity CVSS v4.0: MEDIUM
Last modification:
17/04/2025

CVE-2025-1290
Publication date:
17/04/2025
A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure <br /> during an AF_VSOCK connect syscall can occur before a worker thread accesses it resulting in a dangling pointer and potential kernel code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-43708
Publication date:
17/04/2025
VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference=&amp;#39;../../../set/set[2]&amp;#39; is used, aka an "insecure deserialization" issue.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025

CVE-2025-24907
Publication date:
16/04/2025
Overview <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &amp;#39;.../...//&amp;#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Description <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API. <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Impact <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Severity CVSS v4.0: Pending analysis
Last modification:
17/04/2025
Subscribe to Vulnerabilities