Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-54048

Publication date:
20/08/2025
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54049

Publication date:
20/08/2025
Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54021

Publication date:
20/08/2025
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54025

Publication date:
20/08/2025
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54027

Publication date:
20/08/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54028

Publication date:
20/08/2025
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows PHP Local File Inclusion.This issue affects CF7 WOW Styler: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54031

Publication date:
20/08/2025
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard allows PHP Local File Inclusion.This issue affects Support Board: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54032

Publication date:
20/08/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54007

Publication date:
20/08/2025
Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54008

Publication date:
20/08/2025
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Retrieve Embedded Sensitive Data.This issue affects JetSmartFilters: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54012

Publication date:
20/08/2025
Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-54014

Publication date:
20/08/2025
Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026