Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-44892
Publication date:
21/05/2025
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_post_rmon_alarm function.
Severity CVSS v4.0: Pending analysis
Last modification:
03/06/2025

CVE-2025-44895
Publication date:
21/05/2025
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function.
Severity CVSS v4.0: Pending analysis
Last modification:
03/06/2025

CVE-2024-42922
Publication date:
21/05/2025
AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
25/06/2025

CVE-2024-56429
Publication date:
21/05/2025
itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to the database.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-48417
Publication date:
21/05/2025
The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin interface. The files are located in /etc/ssl (e.g. salia.local.crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-1419
Publication date:
21/05/2025
Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.<br /> <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: LOW
Last modification:
15/04/2026

CVE-2025-1420
Publication date:
21/05/2025
Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.<br /> <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: LOW
Last modification:
15/04/2026

CVE-2025-1421
Publication date:
21/05/2025
Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user&amp;#39;s PC.<br /> <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: LOW
Last modification:
15/04/2026

CVE-2025-40775
Publication date:
21/05/2025
When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure.<br /> This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-48415
Publication date:
21/05/2025
A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor  or perform other administrative actions. Ultimately, this backdoor also allows arbitrary execution of OS commands.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-48416
Publication date:
21/05/2025
An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-1417
Publication date:
21/05/2025
In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of CVE-2025-1416.<br /> <br /> Successful exploitation requires UUID of a targeted backup, which cannot be brute forced. <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: MEDIUM
Last modification:
15/04/2026
Subscribe to Vulnerabilities