Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-49211

Publication date:

22/10/2024

Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2024

CVE-2024-9287

Publication date:

22/10/2024

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren&#39;t activated before being used (ie "./venv/bin/python") are not affected.

Severity CVSS v4.0: MEDIUM

Last modification:

03/11/2025

CVE-2024-9129

Publication date:

22/10/2024

In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. <br /> <br /> Reported by Dylan Marino

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

CVE-2024-49209

Publication date:

22/10/2024

Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and upload additional system icons.

Severity CVSS v4.0: Pending analysis

Last modification:

14/03/2025

CVE-2024-49210

Publication date:

22/10/2024

Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2024

CVE-2024-48570

Publication date:

22/10/2024

Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdates-reports-ds.php.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2024

CVE-2024-48706

Publication date:

22/10/2024

Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform within the (a) managemessage.php file and (b) managetask.php file respectively.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2025

CVE-2024-48707

Publication date:

22/10/2024

Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) action=addpro within admin.php file.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2024

CVE-2024-48708

Publication date:

22/10/2024

Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php under action = adduser/edituser.

Severity CVSS v4.0: Pending analysis

Last modification:

25/10/2024

CVE-2024-49208

Publication date:

22/10/2024

Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and delete system icons.

Severity CVSS v4.0: Pending analysis

Last modification:

14/03/2025

CVE-2024-45518

Publication date:

22/10/2024

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2024

CVE-2024-46538

Publication date:

22/10/2024

A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2024

Subscribe to Vulnerabilities