Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-11238

Publication date:

15/11/2024

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

19/11/2024

CVE-2023-4348

Publication date:

15/11/2024

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Severity CVSS v4.0: Pending analysis

Last modification:

15/11/2024

CVE-2024-11237

Publication date:

15/11/2024

A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: HIGH

Last modification:

19/11/2024

CVE-2024-11182

Publication date:

15/11/2024

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user&#39;s browser window.

Severity CVSS v4.0: MEDIUM

Last modification:

30/10/2025

CVE-2024-10534

Publication date:

15/11/2024

Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traffic Injection.This issue affects Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS): before 2024.

Severity CVSS v4.0: HIGH

Last modification:

19/11/2024

CVE-2024-1097

Publication date:

15/11/2024

A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the &#39;Report Name&#39; input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report, potentially leading to the theft of user accounts and cookies.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2024-1240

Publication date:

15/11/2024

An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the &#39;next&#39; parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2024-0787

Publication date:

15/11/2024

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the &#39;X-Forwarded-For&#39; header. The issue lies in the &#39;get_user_ip()&#39; function in &#39;class.Common.php&#39; at lines 1044 and 1045, where the presence of the &#39;X-Forwarded-For&#39; header is checked and used instead of &#39;REMOTE_ADDR&#39;. This vulnerability allows attackers to perform brute force attacks on user accounts, including the admin account. The issue is fixed in version 1.7.0.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2024-0875

Publication date:

15/11/2024

A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the &#39;inputBody&#39; field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2024-10443

Publication date:

15/11/2024

Improper neutralization of special elements used in an OS command (&#39;OS Command Injection&#39;) vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

16/09/2025

CVE-2023-0109

Publication date:

15/11/2024

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2023-0737

Publication date:

15/11/2024

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

Subscribe to Vulnerabilities