Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-64400

Publication date:

18/12/2025

Control Panel provides an API for pre-registering into an enrollment and organization prior to a user&#39;s first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2025

CVE-2025-65566

Publication date:

18/12/2025

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead of rejecting the malformed message. This triggers a panic and terminates the UPF process. An attacker who can send PFCP Session Report Response messages to the UPF&#39;s N4/PFCP endpoint can exploit this flaw to repeatedly crash the UPF and disrupt user-plane services.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2026

CVE-2025-14889

Publication date:

18/12/2025

A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unknown function of the file /admin/voters_edit.php of the component Password Handler. Performing manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

Severity CVSS v4.0: MEDIUM

Last modification:

24/12/2025

CVE-2024-58321

Publication date:

18/12/2025

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers can exploit this vulnerability to execute malicious scripts that will run in users&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2024-58322

Publication date:

18/12/2025

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead to potential theft of sensitive data by executing malicious scripts in users&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2024-58323

Publication date:

18/12/2025

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows malicious scripts to execute in users&#39; browsers by exploiting HTML support in the form builder.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2024-58317

Publication date:

18/12/2025

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the &#39;requireSSL&#39; attribute, potentially compromising session security and authentication state.

Severity CVSS v4.0: MEDIUM

Last modification:

24/12/2025

CVE-2024-58320

Publication date:

18/12/2025

An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication. Attackers can retrieve confidential hostname configuration information through a public endpoint, potentially exposing internal network details.

Severity CVSS v4.0: MEDIUM

Last modification:

24/12/2025

CVE-2023-53944

Publication date:

18/12/2025

EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassing SecurityManager restrictions. Attackers can send GET requests with encoded directory traversal sequences like /..%5c..%5c to read system files such as /windows/win.ini.

Severity CVSS v4.0: HIGH

Last modification:

26/12/2025

CVE-2024-58318

Publication date:

18/12/2025

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and form builders. Attackers can exploit this vulnerability by entering malicious URIs, potentially allowing malicious scripts to execute in users&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2024-58319

Publication date:

18/12/2025

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog. Attackers can exploit this vulnerability to execute malicious scripts in administrative users&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2023-53940

Publication date:

18/12/2025

Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown file. Attackers can embed a video source with an onerror event that executes shell commands through Node.js child_process module when the file is opened.

Severity CVSS v4.0: HIGH

Last modification:

19/12/2025

Subscribe to Vulnerabilities