Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-58300

Publication date:

11/12/2025

Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated credentials via a network request. Attackers can send a specific hex-encoded command to port 12777 to obtain username and password, enabling direct SSH access to the device.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58301

Publication date:

11/12/2025

Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters. Attackers can exploit vulnerable endpoints like getAllParks.php and events-ajax.php by injecting crafted SQL payloads to potentially extract or modify database information.

Severity CVSS v4.0: CRITICAL

Last modification:

12/12/2025

CVE-2024-58302

Publication date:

11/12/2025

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Attackers can exploit the template settings by inserting file inclusion payloads to read sensitive system files like /etc/passwd during email generation.

Severity CVSS v4.0: MEDIUM

Last modification:

12/12/2025

CVE-2024-58303

Publication date:

11/12/2025

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58304

Publication date:

11/12/2025

SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the &#39;descr&#39; parameter in the product edit form to execute arbitrary code in administrative users&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

12/12/2025

CVE-2024-58292

Publication date:

11/12/2025

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, enabling script execution for all forum users when pages are rendered.

Severity CVSS v4.0: MEDIUM

Last modification:

12/12/2025

CVE-2024-58293

Publication date:

11/12/2025

Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58294

Publication date:

11/12/2025

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the &#39;generatedocs&#39; endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58295

Publication date:

11/12/2025

ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme installation process. Attackers can upload a ZIP archive with a PHP file containing system commands, which can then be executed by accessing the uploaded file in the theme directory.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

CVE-2024-58296

Publication date:

11/12/2025

CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.

Severity CVSS v4.0: MEDIUM

Last modification:

12/12/2025

CVE-2024-58297

Publication date:

11/12/2025

PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. Attackers can insert a payload in the &#39;Redirect From&#39; field to execute arbitrary JavaScript when administrators view the redirects page.

Severity CVSS v4.0: MEDIUM

Last modification:

12/12/2025

CVE-2024-58287

Publication date:

11/12/2025

reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands. Attackers can modify the nmap_cmd parameter with malicious base64-encoded payloads to achieve remote code execution during scan engine configuration.

Severity CVSS v4.0: HIGH

Last modification:

12/12/2025

Subscribe to Vulnerabilities