Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-52163

Publication date:
03/02/2025
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2025

CVE-2023-52164

Publication date:
03/02/2025
access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2025

CVE-2024-34896

Publication date:
03/02/2025
An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection with the device to still have access to live video feed.
Severity CVSS v4.0: Pending analysis
Last modification:
14/03/2025

CVE-2024-34897

Publication date:
03/02/2025
Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
18/03/2025

CVE-2024-44449

Publication date:
03/02/2025
Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login page.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2025

CVE-2025-25181

Publication date:
03/02/2025
A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
13/03/2025

CVE-2025-25064

Publication date:
03/02/2025
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2025

CVE-2025-25065

Publication date:
03/02/2025
SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.
Severity CVSS v4.0: Pending analysis
Last modification:
11/06/2025

CVE-2024-57968

Publication date:
03/02/2025
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.
Severity CVSS v4.0: Pending analysis
Last modification:
13/03/2025

CVE-2025-22978

Publication date:
03/02/2025
eladmin
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2025

CVE-2024-57669

Publication date:
03/02/2025
Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file.
Severity CVSS v4.0: Pending analysis
Last modification:
18/03/2025

CVE-2024-57098

Publication date:
03/02/2025
Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
18/03/2025