Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-25282

Publication date:

08/01/2026

V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to manipulate the &#39;parent&#39; GET parameter. Attackers can craft malicious links that redirect logged-in users to arbitrary websites by exploiting improper input validation in the redirect mechanism.

Severity CVSS v4.0: MEDIUM

Last modification:

08/01/2026

CVE-2019-25289

Publication date:

08/01/2026

SmartLiving SmartLAN

Severity CVSS v4.0: HIGH

Last modification:

08/01/2026

CVE-2019-25290

Publication date:

08/01/2026

Smartliving SmartLAN/G/SI

Severity CVSS v4.0: MEDIUM

Last modification:

08/01/2026

CVE-2019-25280

Publication date:

08/01/2026

Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML code through the &#39;speed&#39; GET parameter. Attackers can inject malicious HTML code in the &#39;speed&#39; parameter of prober.php to trigger cross-site scripting in user browser sessions.

Severity CVSS v4.0: MEDIUM

Last modification:

08/01/2026

CVE-2019-25284

Publication date:

08/01/2026

V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper input sanitization in various script parameters. Attackers can exploit these vulnerabilities by injecting malicious HTML and script code to execute arbitrary scripts in a victim&#39;s browser session.

Severity CVSS v4.0: MEDIUM

Last modification:

08/01/2026

CVE-2019-25279

Publication date:

08/01/2026

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device&#39;s SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.

Severity CVSS v4.0: MEDIUM

Last modification:

16/01/2026

CVE-2019-25231

Publication date:

08/01/2026

devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the &#39;DevoloNetworkService&#39; that allows local non-privileged users to potentially execute arbitrary code. Attackers can exploit the insecure service path configuration by inserting malicious code in the system root path to execute with elevated privileges during application startup or system reboot.

Severity CVSS v4.0: HIGH

Last modification:

08/01/2026

CVE-2019-25259

Publication date:

08/01/2026

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can trick logged-in users into executing unauthorized actions by crafting malicious web pages that submit requests to the application.

Severity CVSS v4.0: MEDIUM

Last modification:

08/01/2026

CVE-2019-25268

Publication date:

08/01/2026

NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files from remote shares. Attackers can exploit insecure library loading of sdl2.dll and libegl.dll by placing malicious libraries on WebDAV or SMB shares to execute unauthorized code.

Severity CVSS v4.0: HIGH

Last modification:

08/01/2026

CVE-2019-25270

Publication date:

08/01/2026

SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the &#39;senddata&#39; POST parameter of logged_page.php that allows attackers to inject malicious scripts. Attackers can exploit this weakness by sending crafted POST requests to execute arbitrary HTML and script code in a victim&#39;s browser session.

Severity CVSS v4.0: MEDIUM

Last modification:

08/01/2026

CVE-2019-25278

Publication date:

08/01/2026

FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authentication information during network communication.

Severity CVSS v4.0: CRITICAL

Last modification:

16/01/2026

CVE-2019-25277

Publication date:

08/01/2026

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the &#39;msg&#39; parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.

Severity CVSS v4.0: MEDIUM

Last modification:

22/01/2026

Subscribe to Vulnerabilities