Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-1097

Publication date:

15/11/2024

A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the &#39;Report Name&#39; input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report, potentially leading to the theft of user accounts and cookies.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2024-10534

Publication date:

15/11/2024

Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traffic Injection.This issue affects Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS): before 2024.

Severity CVSS v4.0: HIGH

Last modification:

19/11/2024

CVE-2024-11182

Publication date:

15/11/2024

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user&#39;s browser window.

Severity CVSS v4.0: MEDIUM

Last modification:

21/05/2025

CVE-2024-0787

Publication date:

15/11/2024

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the &#39;X-Forwarded-For&#39; header. The issue lies in the &#39;get_user_ip()&#39; function in &#39;class.Common.php&#39; at lines 1044 and 1045, where the presence of the &#39;X-Forwarded-For&#39; header is checked and used instead of &#39;REMOTE_ADDR&#39;. This vulnerability allows attackers to perform brute force attacks on user accounts, including the admin account. The issue is fixed in version 1.7.0.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2024-0875

Publication date:

15/11/2024

A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the &#39;inputBody&#39; field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially compromising their account. This issue is fixed in version 7.0.2.1.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2024-10443

Publication date:

15/11/2024

Improper neutralization of special elements used in a command (&#39;Command Injection&#39;) vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2025

CVE-2023-0737

Publication date:

15/11/2024

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2023-0109

Publication date:

15/11/2024

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2023-4679

Publication date:

15/11/2024

A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38. This vulnerability can lead to a double-free condition, which may cause the application to crash.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2023-2332

Publication date:

15/11/2024

A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user&#39;s browser, potentially stealing cookies or redirecting users to malicious sites. The issue is fixed in version 10.5.21.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2022-1884

Publication date:

15/11/2024

A remote command execution vulnerability exists in gogs/gogs versions

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

CVE-2022-1226

Publication date:

15/11/2024

A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim&#39;s browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts.

Severity CVSS v4.0: Pending analysis

Last modification:

19/11/2024

Subscribe to Vulnerabilities