Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-41242

Publication date:

18/08/2025

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Severity CVSS v4.0: Pending analysis

Last modification:

18/08/2025

CVE-2025-47206

Publication date:

18/08/2025

An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4933 and later

Severity CVSS v4.0: HIGH

Last modification:

12/09/2025

CVE-2025-5296

Publication date:

18/08/2025

CWE-59: Improper Link Resolution Before File Access (&#39;Link Following&#39;) vulnerability exists that could cause arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruption, exposure of application and system information or persistent denial of service when a low-privileged attacker tampers with the installation folder.

Severity CVSS v4.0: HIGH

Last modification:

18/08/2025

CVE-2025-57701

Publication date:

18/08/2025

DIAEnergie - Reflected Cross-site Scripting

Severity CVSS v4.0: MEDIUM

Last modification:

21/08/2025

CVE-2025-57702

Publication date:

18/08/2025

DIAEnergie - Reflected Cross-site Scripting

Severity CVSS v4.0: MEDIUM

Last modification:

21/08/2025

CVE-2025-57703

Publication date:

18/08/2025

DIAEnergie - Reflected Cross-site Scripting

Severity CVSS v4.0: MEDIUM

Last modification:

21/08/2025

CVE-2025-6625

Publication date:

18/08/2025

CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device.

Severity CVSS v4.0: HIGH

Last modification:

18/08/2025

CVE-2025-57700

Publication date:

18/08/2025

DIAEnergie - Stored Cross-site Scripting

Severity CVSS v4.0: HIGH

Last modification:

21/08/2025

CVE-2025-9109

Publication date:

18/08/2025

A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email of the component Password Recovery Endpoint. The manipulation results in observable response discrepancy. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.

Severity CVSS v4.0: MEDIUM

Last modification:

10/09/2025

CVE-2025-9108

Publication date:

18/08/2025

Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the attack remotely.

Severity CVSS v4.0: MEDIUM

Last modification:

18/08/2025

CVE-2025-9107

Publication date:

18/08/2025

A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

02/09/2025

CVE-2025-9106

Publication date:

18/08/2025

A vulnerability was found in Portabilis i-Diario up to 1.5.0. This affects an unknown function of the file /planos-de-ensino-por-disciplina/ of the component Informações Adicionais Page. Performing manipulation of the argument Parecer/Conteúdos/Objetivos results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

02/09/2025

Subscribe to Vulnerabilities