Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-14518
Publication date:
15/08/2019
Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2024

CVE-2019-14784
Publication date:
15/08/2019
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2019

CVE-2019-13578
Publication date:
15/08/2019
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2023

CVE-2019-3417
Publication date:
15/08/2019
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. Due to insufficient parameter validation check, an authorized user can exploit this vulnerability to take control of user router system.
Severity CVSS v4.0: Pending analysis
Last modification:
03/03/2023

CVE-2019-3418
Publication date:
15/08/2019
All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due to incomplete input validation, an authorized user can exploit this vulnerability to execute malicious scripts.
Severity CVSS v4.0: Pending analysis
Last modification:
02/03/2023

CVE-2019-15081
Publication date:
15/08/2019
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
Severity CVSS v4.0: Pending analysis
Last modification:
02/03/2023

CVE-2019-14800
Publication date:
15/08/2019
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
Severity CVSS v4.0: Pending analysis
Last modification:
21/08/2019

CVE-2019-14795
Publication date:
15/08/2019
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
21/08/2019

CVE-2019-14790
Publication date:
15/08/2019
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
Severity CVSS v4.0: Pending analysis
Last modification:
21/08/2019

CVE-2019-14755
Publication date:
15/08/2019
The profile photo upload feature in Leaf Admin 61.9.0212.10 f allows Unrestricted Upload of a File with a Dangerous Type.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2019

CVE-2019-15062
Publication date:
14/08/2019
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
Severity CVSS v4.0: Pending analysis
Last modification:
17/11/2022

CVE-2019-14427
Publication date:
14/08/2019
XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code.
Severity CVSS v4.0: Pending analysis
Last modification:
26/08/2019
Subscribe to Vulnerabilities