Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-69365

Publication date:
20/02/2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injection.This issue affects Uroan Core: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69366

Publication date:
20/02/2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69367

Publication date:
20/02/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69308

Publication date:
20/02/2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL Injection.This issue affects Nestbyte Core: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69309

Publication date:
20/02/2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69310

Publication date:
20/02/2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Injection.This issue affects Woodly Core: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69322

Publication date:
20/02/2026
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes PeakShops peakshops allows PHP Local File Inclusion.This issue affects PeakShops: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69323

Publication date:
20/02/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Reflected XSS.This issue affects Slimstat Analytics: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69324

Publication date:
20/02/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69325

Publication date:
20/02/2026
Path Traversal: '.../...//' vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Path Traversal.This issue affects Primer MyData for Woocommerce: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69326

Publication date:
20/02/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2025-69302

Publication date:
20/02/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026