Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-47766

Publication date:

15/01/2026

Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the &#39;tipocomb&#39; parameter of kmaleonW.php that allows attackers to manipulate database queries. Attackers can exploit this vulnerability using boolean-based, error-based, and time-based blind SQL injection techniques to potentially extract or manipulate database information.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2021-47764

Publication date:

15/01/2026

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Attackers can generate a 1000-character payload and paste it into specific input fields to trigger application crashes and force unexpected termination.

Severity CVSS v4.0: MEDIUM

Last modification:

26/01/2026

CVE-2021-47765

Publication date:

15/01/2026

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report fields. Attackers can trigger the crash by inserting 1000 characters into the username or email address fields, causing the application to become unresponsive.

Severity CVSS v4.0: MEDIUM

Last modification:

26/01/2026

CVE-2021-47761

Publication date:

15/01/2026

MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can replace the mysqld.exe with a malicious executable, which will execute with system privileges when the computer restarts.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2021-47762

Publication date:

15/01/2026

HTTPDebuggerPro 9.11 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables and gain elevated access to the system.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2021-47763

Publication date:

15/01/2026

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api &#39;sort&#39; parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2021-47760

Publication date:

15/01/2026

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate.

Severity CVSS v4.0: MEDIUM

Last modification:

22/01/2026

CVE-2021-47753

Publication date:

15/01/2026

phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension checks. Attackers can upload a PHP file disguised as a PNG, rename it, and execute system commands through a crafted web shell parameter.

Severity CVSS v4.0: CRITICAL

Last modification:

23/01/2026

CVE-2021-47754

Publication date:

15/01/2026

Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious form to change user details, including passwords, email, and administrative privileges by tricking authenticated users into submitting the form.

Severity CVSS v4.0: MEDIUM

Last modification:

26/01/2026

CVE-2021-47755

Publication date:

15/01/2026

Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the &#39;fileName&#39; parameter to download sensitive files from the server&#39;s filesystem.

Severity CVSS v4.0: HIGH

Last modification:

26/01/2026

CVE-2021-47757

Publication date:

15/01/2026

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server.

Severity CVSS v4.0: HIGH

Last modification:

23/01/2026

CVE-2021-47758

Publication date:

15/01/2026

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables arbitrary command execution on the server through a weaponized PHP script.

Severity CVSS v4.0: HIGH

Last modification:

03/02/2026

Subscribe to Vulnerabilities