Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-51063

Publication date:

31/10/2024

Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

31/03/2025

CVE-2024-51064

Publication date:

31/10/2024

Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php.

Severity CVSS v4.0: Pending analysis

Last modification:

31/03/2025

CVE-2024-51065

Publication date:

31/10/2024

Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

31/03/2025

CVE-2024-51066

Publication date:

31/10/2024

An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul&#39;s Beauty Parlour Management System v1.1 allows unauthorized access to the Personally Identifiable Information (PII) of other customers.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2023-52044

Publication date:

31/10/2024

Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extension.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2025

CVE-2023-52045

Publication date:

31/10/2024

Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2025

CVE-2024-10573

Publication date:

31/10/2024

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector.

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2024

CVE-2024-39332

Publication date:

31/10/2024

Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execution via modification of shell scripts on the server.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2025

CVE-2024-42515

Publication date:

31/10/2024

Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., ), the underlying library converts these encoded characters into legitimate HTML, thereby possibly causing stored XSS. Attackers can append a XSS payload to a word that has a corresponding glossary entry.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

CVE-2024-50347

Publication date:

31/10/2024

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb&#39;s Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information (such as number of connections) about a given channel. This issue only affects the Pusher-compatible API endpoints and not the WebSocket connections themselves. In order to exploit this vulnerability, the application ID which, should never be exposed, would need to be known by an attacker. This vulnerability is fixed in 1.4.0.

Severity CVSS v4.0: MEDIUM

Last modification:

01/11/2024

CVE-2024-51482

Publication date:

31/10/2024

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.*

Severity CVSS v4.0: Pending analysis

Last modification:

05/11/2024

CVE-2024-50356

Publication date:

31/10/2024

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even though they wouldn&#39;t be able to login by bypassing the 2FA. Only users who have enabled 2FA are affected. Commit ba0007c28ac814260f836849bc07d29beea7deb6 patches this bug.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

Subscribe to Vulnerabilities