Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-37057

Publication date:

30/01/2026

Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the &#39;fid&#39; parameter. Attackers can inject malicious SQL code into the &#39;fid&#39; parameter to potentially extract, modify, or delete database information.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37043

Publication date:

30/01/2026

10-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections through carefully crafted input. Attackers can exploit the vulnerability by sending a malicious payload to the application&#39;s registration key input, enabling remote code execution and launching arbitrary system commands.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37044

Publication date:

30/01/2026

OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicious payload in the query string, leading to execution of JavaScript in the victim&#39;s browser. For example, a request to /graphql?&#39;"-->alert(&#39;Raif_Berkay&#39;) will trigger an alert. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.

Severity CVSS v4.0: MEDIUM

Last modification:

30/01/2026

CVE-2020-37046

Publication date:

30/01/2026

Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users through the tambahuser.php endpoint. Attackers can craft a malicious HTML form to submit admin credentials and create new administrative accounts without the victim&#39;s consent.

Severity CVSS v4.0: MEDIUM

Last modification:

30/01/2026

CVE-2020-37049

Publication date:

30/01/2026

Frigate 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows attackers to execute arbitrary code. Attackers can craft a malicious payload to overflow the buffer, bypass DEP, and execute commands like launching calc.exe through a specially crafted input sequence.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37050

Publication date:

30/01/2026

Quick Player 1.3 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious .m3l file with carefully constructed payload. Attackers can trigger the vulnerability by loading a specially crafted file through the application&#39;s file loading mechanism, potentially enabling remote code execution.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37051

Publication date:

30/01/2026

Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes. Attackers can exploit the &#39;feed.php&#39; endpoint by crafting malicious payload requests that use time delays to systematically enumerate user password characters.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37036

Publication date:

30/01/2026

RM Downloader 2.50.60 contains a local buffer overflow vulnerability in the &#39;Load&#39; parameter that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload with an egg hunter technique to bypass memory protections and execute commands like launching calc.exe.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37038

Publication date:

30/01/2026

Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field. Attackers can paste a large payload of 5000 repeated characters into the search field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

30/01/2026

CVE-2020-37039

Publication date:

30/01/2026

Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the command line interface. Attackers can generate a payload of 8000 repeated characters and paste it into the application&#39;s command line field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

30/01/2026

CVE-2020-37040

Publication date:

30/01/2026

Code Blocks 17.12 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious file name with Unicode characters. Attackers can trigger the vulnerability by pasting a specially crafted payload into the file name field during project creation, potentially executing system commands like calc.exe.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37041

Publication date:

30/01/2026

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., &#39;../&#39;) in the URL. For example, requesting /static/css//../../../../../../../../etc/passwd returns the contents of /etc/passwd. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

Subscribe to Vulnerabilities