Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-14983

Publication date:
22/06/2020
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-1727

Publication date:
22/06/2020
A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2020-11989

Publication date:
22/06/2020
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-3865

Publication date:
22/06/2020
A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-13480

Publication date:
22/06/2020
Verint Workforce Optimization (WFO) 15.2 allows HTML injection via the "send email" feature.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-13158

Publication date:
22/06/2020
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-13159

Publication date:
22/06/2020
Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name, Server domain name, dhclient_mac, Hostname, or Alias field. NOTE: this may overlap CVE-2020-10818.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-13426

Publication date:
22/06/2020
The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-13427

Publication date:
22/06/2020
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-14972

Publication date:
22/06/2020
Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-14973

Publication date:
22/06/2020
The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2020-14980

Publication date:
22/06/2020
The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026