Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-59369

Publication date:

25/11/2025

A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary SQL queries, leading to unauthorized data access. <br /> Refer to the &#39;Security Update for ASUS Router Firmware&#39; section on the ASUS Security Advisory for more information.

Severity CVSS v4.0: MEDIUM

Last modification:

25/11/2025

CVE-2025-59370

Publication date:

25/11/2025

A command injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary commands, leading to the device executing unintended instructions.<br /> Refer to the &#39;Security Update for ASUS Router Firmware&#39; section on the ASUS Security Advisory for more information.

Severity CVSS v4.0: HIGH

Last modification:

25/11/2025

CVE-2025-59371

Publication date:

25/11/2025

An authentication bypass vulnerability has been identified in the IFTTT integration feature. A remote, authenticated attacker could leverage this vulnerability to potentially gain unauthorized access to the device. This vulnerability does not affect Wi-Fi 7 series models.<br /> Refer to the &#39;Security Update for ASUS Router Firmware&#39; section on the ASUS Security Advisory for more information.

Severity CVSS v4.0: HIGH

Last modification:

25/11/2025

CVE-2025-13502

Publication date:

25/11/2025

A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.

Severity CVSS v4.0: Pending analysis

Last modification:

06/02/2026

CVE-2025-13404

Publication date:

25/11/2025

The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing authorization validation on the duplicate_post() function in all versions up to, and including, 1.2.20. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, including private and password-protected posts, leading to data exposure.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2025-13414

Publication date:

25/11/2025

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2025-13452

Publication date:

25/11/2025

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2025-13389

Publication date:

25/11/2025

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2025-13405

Publication date:

25/11/2025

The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delete_custom_taxonomy() function in all versions up to, and including, 1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary custom taxonomies.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2025-13380

Publication date:

25/11/2025

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the &#39;lqdai_update_post&#39; AJAX endpoint and the use of file_get_contents() with user-controlled URLs without protocol restrictions in the insert_image() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2025-13385

Publication date:

25/11/2025

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2025-13386

Publication date:

25/11/2025

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the &#39;options_update&#39; function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin&#39;s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

Subscribe to Vulnerabilities