Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-39383

Publication date:

24/04/2025

Improper Control of Filename for Include/Require Statement in PHP Program (&#39;PHP Remote File Inclusion&#39;) vulnerability in codeworkweb Xews Lite xews-lite allows PHP Local File Inclusion.This issue affects Xews Lite: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2025-39384

Publication date:

24/04/2025

Improper Control of Filename for Include/Require Statement in PHP Program (&#39;PHP Remote File Inclusion&#39;) vulnerability in cedcommerce Product Lister for eBay product-lister-ebay allows PHP Local File Inclusion.This issue affects Product Lister for eBay: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2025-39385

Publication date:

24/04/2025

Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2025-32921

Publication date:

24/04/2025

Improper Control of Filename for Include/Require Statement in PHP Program (&#39;PHP Remote File Inclusion&#39;) vulnerability in wpoperations Arrival arrival allows PHP Local File Inclusion.This issue affects Arrival: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2025-39359

Publication date:

24/04/2025

Improper Control of Filename for Include/Require Statement in PHP Program (&#39;PHP Remote File Inclusion&#39;) vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2025-39360

Publication date:

24/04/2025

Improper Control of Filename for Include/Require Statement in PHP Program (&#39;PHP Remote File Inclusion&#39;) vulnerability in everestthemes Grace Mag grace-mag allows PHP Local File Inclusion.This issue affects Grace Mag: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2024-30148

Publication date:

24/04/2025

Improper access control of endpoint in HCL Leap<br /> allows certain admin users to import applications from the<br /> server&#39;s filesystem.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-44134

Publication date:

24/04/2025

A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class_save.php. Manipulation of parameter class will lead to SQL injection attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

14/05/2025

CVE-2025-44135

Publication date:

24/04/2025

A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php. Manipulating the parameter username will cause SQL injection attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

14/05/2025

CVE-2025-29568

Publication date:

24/04/2025

A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. The issue affects some unknown features in the file /Scheduling/pages/class_sched.php. Manipulating the class parameter can lead to cross-site scripting (XSS).

Severity CVSS v4.0: Pending analysis

Last modification:

14/05/2025

CVE-2025-43855

Publication date:

24/04/2025

tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. This issue has been patched in version 11.1.1.

Severity CVSS v4.0: HIGH

Last modification:

29/04/2025

CVE-2025-30408

Publication date:

24/04/2025

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 16 (Windows) before build 39938.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2025

Subscribe to Vulnerabilities