Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-11132

Publication date:

03/02/2025

The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

04/03/2025

CVE-2024-11133

Publication date:

03/02/2025

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the &#39;handle_pdf_download_request&#39; function in all versions up to, and including, 3.9.9. This makes it possible for unauthenticated attackers to download event tickets.

Severity CVSS v4.0: Pending analysis

Last modification:

04/03/2025

CVE-2024-11134

Publication date:

03/02/2025

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the &#39;eventer_export_bookings_csv&#39; function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to download bookings, which contains customers&#39; personal data.

Severity CVSS v4.0: Pending analysis

Last modification:

04/03/2025

CVE-2024-12511

Publication date:

03/02/2025

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.

Severity CVSS v4.0: Pending analysis

Last modification:

17/09/2025

CVE-2024-12859

Publication date:

03/02/2025

The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the &#39;boombox_listing&#39; shortcode &#39;type&#39; attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2025

CVE-2024-57237

Publication date:

03/02/2025

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint. The vulnerability arises because the cmd parameter does not properly sanitize input and the response is served with a Content-Type of text/html. This behavior allows the browser to execute injected JavaScript code.

Severity CVSS v4.0: Pending analysis

Last modification:

03/03/2025

CVE-2024-57238

Publication date:

03/02/2025

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the order_by parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2025

CVE-2024-50656

Publication date:

03/02/2025

itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.

Severity CVSS v4.0: Pending analysis

Last modification:

19/03/2025

CVE-2024-57004

Publication date:

03/02/2025

Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2025

CVE-2024-12510

Publication date:

03/02/2025

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2025

CVE-2025-24898

Publication date:

03/02/2025

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument&#39;s buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer&#39;s lifetime is shorter than the `client` buffer&#39;s, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer&#39;s lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.

Severity CVSS v4.0: MEDIUM

Last modification:

11/02/2025

CVE-2024-56161

Publication date:

03/02/2025

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2025

Subscribe to Vulnerabilities