Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-58306

Publication date:

11/12/2025

minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can send crafted HTTP requests with excessive data to overwhelm the server and cause service interruption.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58307

Publication date:

11/12/2025

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.

Severity CVSS v4.0: CRITICAL

Last modification:

12/12/2025

CVE-2024-58308

Publication date:

11/12/2025

Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attackers can inject specific SQL payloads like &#39; or &#39;1&#39;=&#39;1 to gain unauthorized administrative access to the system.

Severity CVSS v4.0: CRITICAL

Last modification:

12/12/2025

CVE-2024-58309

Publication date:

11/12/2025

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58310

Publication date:

11/12/2025

APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like /etc/passwd by using encoded path traversal characters in HTTP requests.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58312

Publication date:

11/12/2025

xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like using encoded path traversal characters in HTTP requests.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58313

Publication date:

11/12/2025

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58298

Publication date:

11/12/2025

Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the &#39;fileName&#39; parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint.

Severity CVSS v4.0: CRITICAL

Last modification:

12/12/2025

CVE-2024-58300

Publication date:

11/12/2025

Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated credentials via a network request. Attackers can send a specific hex-encoded command to port 12777 to obtain username and password, enabling direct SSH access to the device.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58301

Publication date:

11/12/2025

Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.

Severity CVSS v4.0: CRITICAL

Last modification:

12/12/2025

CVE-2024-58302

Publication date:

11/12/2025

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.

Severity CVSS v4.0: MEDIUM

Last modification:

12/12/2025

CVE-2024-58303

Publication date:

11/12/2025

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

Subscribe to Vulnerabilities