Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-25329

Publication date:

12/02/2026

FTP Navigator 8.03 contains a denial of service vulnerability that allows attackers to crash the application by overwriting Structured Exception Handler (SEH) with malicious input. Attackers can generate a payload of 4108 &#39;A&#39; characters followed by 4 &#39;B&#39; characters and 40 &#39;C&#39; characters to trigger a program crash when pasted into the custom command input.

Severity CVSS v4.0: MEDIUM

Last modification:

12/02/2026

CVE-2019-25330

Publication date:

12/02/2026

SurfOffline Professional 2.2.0.103 contains a structured exception handler (SEH) overflow vulnerability that allows attackers to crash the application by manipulating the project name input. Attackers can generate a malicious payload of 382 &#39;A&#39; characters followed by specific byte sequences to trigger a denial of service condition and overwrite SEH registers.

Severity CVSS v4.0: MEDIUM

Last modification:

12/02/2026

CVE-2019-25331

Publication date:

12/02/2026

AVS Audio Converter 9.1 contains a local buffer overflow vulnerability that allows local attackers to overwrite CPU registers by manipulating the &#39;Exit folder&#39; input field. Attackers can craft a specially designed text file with 264 bytes of padding followed by register overwrite values to compromise the application and potentially execute arbitrary code.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25323

Publication date:

12/02/2026

Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. Attackers can craft specially formatted POST requests to the outputtitle parameter to execute arbitrary HTML and potentially manipulate the web interface&#39;s displayed content.

Severity CVSS v4.0: MEDIUM

Last modification:

12/02/2026

CVE-2019-25324

Publication date:

12/02/2026

RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to inject malicious HTML code. Attackers can exploit the entryNameIn and entryDisplayNameIn parameters to insert arbitrary HTML content, potentially enabling cross-site scripting attacks.

Severity CVSS v4.0: MEDIUM

Last modification:

12/02/2026

CVE-2019-25325

Publication date:

12/02/2026

Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by manipulating the &#39;user&#39; POST parameter. Attackers can inject malicious SQL code like &#39; or 1=1# to manipulate login queries and gain unauthorized access to the application.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25327

Publication date:

12/02/2026

Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the PrimeNet user ID and proxy host fields to trigger a bind shell on port 3110.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25328

Publication date:

12/02/2026

XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application. Attackers can generate a 9000-byte buffer of repeated characters and paste it into the registration code field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

12/02/2026

CVE-2019-25319

Publication date:

12/02/2026

Domain Quester Pro 6.02 contains a stack overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload targeting the &#39;Domain Name Keywords&#39; input field to trigger an access violation and execute a bind shell on port 9999.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25320

Publication date:

12/02/2026

E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating login parameters. Attackers can exploit the /login.php file by sending a specific payload &#39;=&#39;&#39;or&#39; to bypass authentication and gain unauthorized access to the system.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25321

Publication date:

12/02/2026

FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload that triggers a buffer overflow when pasted into the Custom Command textbox, enabling remote code execution and launching the calculator as proof of concept.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25322

Publication date:

12/02/2026

Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can access the device by using the hard-coded username &#39;admin&#39; and password &#39;admin&#39; in the hidden form input fields.

Severity CVSS v4.0: CRITICAL

Last modification:

12/02/2026

Subscribe to Vulnerabilities