Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-22168

Publication date:

24/06/2024

A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.

Severity CVSS v4.0: Pending analysis

Last modification:

25/06/2024

CVE-2024-34988

Publication date:

24/06/2024

SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul)

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2024

CVE-2024-34992

Publication date:

24/06/2024

SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via &#39;Tickets::getsearchedtickets()&#39;

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2024

CVE-2024-36681

Publication date:

24/06/2024

SQL Injection vulnerability in the module "Isotope" (pk_isotope)

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2024

CVE-2024-36683

Publication date:

24/06/2024

SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2024

CVE-2023-45195

Publication date:

24/06/2024

Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

Severity CVSS v4.0: MEDIUM

Last modification:

15/10/2025

CVE-2024-33898

Publication date:

24/06/2024

Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote attackers to achieve unauthenticated remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

06/02/2025

CVE-2024-34991

Publication date:

24/06/2024

In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / postal address / email / etc. without restriction due to a lack of permissions control.

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2024

CVE-2024-36682

Publication date:

24/06/2024

In the module "Theme settings" (pk_themesettings)

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2024

CVE-2024-6290

Publication date:

24/06/2024

Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2024

CVE-2024-6291

Publication date:

24/06/2024

Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2024

CVE-2024-6292

Publication date:

24/06/2024

Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2024

Subscribe to Vulnerabilities