Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-43595

Publication date:

01/05/2025

An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the &#39;Online Backup&#39; folder. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22).

Severity CVSS v4.0: HIGH

Last modification:

23/09/2025

CVE-2025-4176

Publication date:

01/05/2025

A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

09/05/2025

CVE-2025-1333

Publication date:

01/05/2025

IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 and configured with Cloud Pak for Integration Keycloak could disclose sensitive information to a privileged user.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2025

CVE-2025-4175

Publication date:

01/05/2025

A vulnerability, which was classified as critical, was found in AlanBinu007 Spring-Boot-Advanced-Projects up to 3.1.3. This affects the function uploadUserProfileImage of the file /Spring-Boot-Advanced-Projects-main/Project-4.SpringBoot-AWS-S3/backend/src/main/java/com/urunov/profile/UserProfileController.java of the component Upload Profile API Endpoint. The manipulation of the argument File leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2024-48905

Publication date:

01/05/2025

Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2025

CVE-2024-48906

Publication date:

01/05/2025

Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2025

CVE-2024-48907

Publication date:

01/05/2025

Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2025

CVE-2025-46631

Publication date:

01/05/2025

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router&#39;s OS by sending a /goform/telnet web request.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46632

Publication date:

01/05/2025

Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted messages between client and server.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46633

Publication date:

01/05/2025

Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server by collecting the symmetric AES key from collected and/or observed traffic. The AES key in sent in cleartext in response to successful authentication. The IV is always EU5H62G9ICGRNI43.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46634

Publication date:

01/05/2025

Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It implements encryption, but not until after the user has transmitted the hash of their password in cleartext. The hash can be replayed to authenticate.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46635

Publication date:

01/05/2025

An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker (who is authenticated to the guest Wi-Fi) to access resources on the router and/or resources and devices on other networks hosted by the router by configuring a static IP address (within the non-guest subnet) on their host.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

Subscribe to Vulnerabilities