Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-12051

Publication date:
08/06/2018
Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general.php, as demonstrated by a .php file with the image/jpeg content type.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12052

Publication date:
08/06/2018
SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12053

Publication date:
08/06/2018
Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using directory traversal.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12054

Publication date:
08/06/2018
Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-9177

Publication date:
08/06/2018
Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-9182

Publication date:
08/06/2018
Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-9246

Publication date:
08/06/2018
The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values used as part of shell command execution, resulting in shell code injection via the create(), run_file(), backup(), or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12041

Publication date:
08/06/2018
An issue was discovered on the MediaTek AWUS036NH wireless USB adapter through 5.1.25.0. Attackers can remotely deny service by sending specially constructed 802.11 frames.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12045

Publication date:
08/06/2018
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12046

Publication date:
08/06/2018
DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12047

Publication date:
08/06/2018
xfind/search in Ximdex 4.0 has XSS via the filter[n][value] parameters for non-negative values of n, as demonstrated by n equal to 0 through 12.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12048

Publication date:
08/06/2018
A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026