Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-13873
Publication date:
02/12/2025
Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, which executes in the browsing context of any visitor accessing the compromised survey.
Severity CVSS v4.0: MEDIUM
Last modification:
02/12/2025

CVE-2025-13870
Publication date:
02/12/2025
Mattermost versions 10.11.x
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2025

CVE-2025-13871
Publication date:
02/12/2025
Cross-Site Request Forgery (CSRF) in the resource-management feature of <br /> <br /> ObjectPlanet Opinio 7.26 rev12562<br /> <br /> allows to upload <br /> files on behalf of the connected users and then access such files without authentication.
Severity CVSS v4.0: LOW
Last modification:
02/12/2025

CVE-2025-13872
Publication date:
02/12/2025
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of <br /> <br /> ObjectPlanet Opinio 7.26 rev12562 on <br /> <br /> Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests <br /> <br /> to an arbitrary destination.
Severity CVSS v4.0: LOW
Last modification:
02/12/2025

CVE-2025-13516
Publication date:
02/12/2025
The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin&amp;#39;s save_file() function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessible directory (wp-content/uploads/suremails/attachments/) without validating file extensions or content types. Files are saved with predictable names derived from MD5 hashes of their content. While the plugin attempts to protect this directory with an Apache .htaccess file to disable PHP execution, this protection is ineffective on nginx, IIS, and Lighttpd servers, or on misconfigured Apache installations. This makes it possible for unauthenticated attackers to achieve Remote Code Execution by uploading malicious PHP files through any public form that emails attachments, calculating the predictable filename, and directly accessing the file to execute arbitrary code granted they are exploiting a site running on an affected web server configuration.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2025

CVE-2025-13534
Publication date:
02/12/2025
The ELEX WordPress HelpDesk &amp; Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WSDesk privileges from limited "Reply Tickets" permissions to full helpdesk administrator capabilities, gaining unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2025

CVE-2025-13724
Publication date:
02/12/2025
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the &amp;#39;month&amp;#39; parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2025

CVE-2025-10543
Publication date:
02/12/2025
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions
Severity CVSS v4.0: MEDIUM
Last modification:
02/12/2025

CVE-2025-13696
Publication date:
02/12/2025
The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a public AJAX endpoint that retrieves form submission data without performing authorization checks to verify ownership or access rights. This makes it possible for unauthenticated attackers to extract sensitive form submission data including personal information, payment details, and other private data via the rocket_front_payment_seesummary action by enumerating sequential form_r_id values.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2025

CVE-2025-11726
Publication date:
02/12/2025
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the &amp;#39;fl-controls/v1&amp;#39; namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2025

CVE-2025-10971
Publication date:
02/12/2025
Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v2.2.5.
Severity CVSS v4.0: HIGH
Last modification:
02/12/2025

CVE-2025-13007
Publication date:
02/12/2025
The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted they can post malicious content to a connected Google Business Profile or Facebook page.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2025
Subscribe to Vulnerabilities