Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-53889

Publication date:

15/12/2025

Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through the assets management interface. Attackers can upload a malicious .phar file with embedded system command execution capabilities to execute arbitrary commands on the server.

Severity CVSS v4.0: HIGH

Last modification:

23/01/2026

CVE-2023-53890

Publication date:

15/12/2025

Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags that execute when the file is viewed, potentially stealing user session information or performing client-side attacks.

Severity CVSS v4.0: MEDIUM

Last modification:

23/01/2026

CVE-2023-53891

Publication date:

15/12/2025

Blackcat CMS 1.4 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into page content. Attackers can insert JavaScript payloads in the page modification interface that execute when other users view the compromised page.

Severity CVSS v4.0: MEDIUM

Last modification:

17/12/2025

CVE-2023-53892

Publication date:

15/12/2025

Blackcat CMS 1.4 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the jquery plugin manager. Attackers can upload a zip file with a PHP shell script and execute arbitrary system commands by accessing the uploaded plugin&#39;s PHP file with a &#39;code&#39; parameter.

Severity CVSS v4.0: HIGH

Last modification:

17/12/2025

CVE-2023-53893

Publication date:

15/12/2025

Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the application to make HTTP, DNS, or file requests to arbitrary destinations.

Severity CVSS v4.0: MEDIUM

Last modification:

18/12/2025

CVE-2023-53888

Publication date:

15/12/2025

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload malicious JavaScript files, rename them to PHP, and execute system commands by exploiting the saveE and rename actions in the application.

Severity CVSS v4.0: HIGH

Last modification:

24/12/2025

CVE-2023-53887

Publication date:

15/12/2025

Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new pages. Attackers can craft malicious image source and onerror attributes to execute arbitrary JavaScript code in victim&#39;s browser.

Severity CVSS v4.0: MEDIUM

Last modification:

24/12/2025

CVE-2023-53886

Publication date:

15/12/2025

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the &#39;Execute Program&#39; configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service condition.

Severity CVSS v4.0: MEDIUM

Last modification:

18/12/2025

CVE-2023-53885

Publication date:

15/12/2025

Webutler v3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload PHP files with system command execution. Attackers can upload a PHAR file with embedded system commands to the media browser and execute arbitrary commands by accessing the uploaded file.

Severity CVSS v4.0: HIGH

Last modification:

18/12/2025

CVE-2023-53884

Publication date:

15/12/2025

Webedition CMS v2.9.8.8 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG files through the media upload feature to inject and execute arbitrary scripts when the file is viewed by other users.

Severity CVSS v4.0: MEDIUM

Last modification:

18/12/2025

CVE-2023-53883

Publication date:

15/12/2025

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server.

Severity CVSS v4.0: HIGH

Last modification:

18/12/2025

CVE-2023-53882

Publication date:

15/12/2025

JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the &#39;q&#39; URL parameter that allows attackers to inject malicious scripts. Attackers can craft malicious links with XSS payloads to steal session tokens or execute arbitrary JavaScript in victims&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

Subscribe to Vulnerabilities