Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-1251

Fecha de publicación:

31/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the &#39;add_reply&#39; function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to steal file attachments uploaded by other users by specifying arbitrary attachment IDs in the &#39;description_attachments&#39; parameter, re-associating those files to their own tickets and removing access from the original owners.

Gravedad CVSS v3.1: MEDIA

Última modificación:

31/01/2026

CVE-2026-0683

Fecha de publicación:

31/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied operand value when using the equals operator and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above (customers), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Gravedad CVSS v3.1: MEDIA

Última modificación:

31/01/2026

CVE-2026-1431

Fecha de publicación:

31/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.

Gravedad CVSS v3.1: MEDIA

Última modificación:

31/01/2026

CVE-2025-15525

Fecha de publicación:

31/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.

Gravedad CVSS v3.1: MEDIA

Última modificación:

31/01/2026

CVE-2025-15510

Fecha de publicación:

31/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter.

Gravedad CVSS v3.1: MEDIA

Última modificación:

31/01/2026

CVE-2026-25156

Fecha de publicación:

30/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Content-Disposition, causing them to be rendered in the user’s browser rather than downloaded. (The intended behavior was for only `text/plain`, `application/pdf`, `image/gif`, `image/jpeg`, and `image/png` to be delivered inline, though adding `save=0` to the document URL could request inline delivery for any document.) This made users who clicked a document link vulnerable to cross-site scripting attacks. An uploaded HTML or SVG document would run in the viewer’s browser with access to their HotCRP credentials, and Javascript in that document could eventually make arbitrary calls to HotCRP’s API. Malicious documents could be uploaded to submission fields with “file upload” or “attachment” type, or as attachments to comments. PDF upload fields were not vulnerable. A search of documents uploaded to hotcrp.com found no evidence of exploitation. The vulnerability was introduced in commit aa20ef288828b04550950cf67c831af8a525f508 (11 October 2025), present in development versions and v3.2, and fixed in commit 8933e86c9f384b356dc4c6e9e2814dee1074b323 and v3.2.1. Additionally, c3d88a7e18d52119c65df31c2cc994edd2beccc5 and v3.2.1 remove support for `save=0`.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/01/2026

CVE-2020-37052

Fecha de publicación:

30/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to run commands with the application&#39;s system privileges.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

30/01/2026

CVE-2020-37053

Fecha de publicación:

30/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the &#39;sidx&#39; parameter in comments. Attackers can exploit the vulnerability to extract user activation keys by using time-based blind SQL injection techniques, potentially enabling password reset for administrative accounts.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/01/2026

CVE-2020-37054

Fecha de publicación:

30/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attackers can trick authenticated administrators into executing arbitrary file uploads by leveraging the extension upload functionality without additional validation.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/01/2026

CVE-2020-37056

Fecha de publicación:

30/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** Crystal Shard http-protection 0.2.0 contains an IP spoofing vulnerability that allows attackers to bypass protection middleware by manipulating request headers. Attackers can hardcode consistent IP values across X-Forwarded-For, X-Client-IP, and X-Real-IP headers to circumvent security checks and gain unauthorized access.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/01/2026

CVE-2020-37057

Fecha de publicación:

30/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the &#39;fid&#39; parameter. Attackers can inject malicious SQL code into the &#39;fid&#39; parameter to potentially extract, modify, or delete database information.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/01/2026

CVE-2020-37043

Fecha de publicación:

30/01/2026

Idioma:

Inglés

*** Pendiente de traducción *** 10-Strike Bandwidth Monitor 3.9 contains a buffer overflow vulnerability that allows attackers to bypass SafeSEH, ASLR, and DEP protections through carefully crafted input. Attackers can exploit the vulnerability by sending a malicious payload to the application&#39;s registration key input, enabling remote code execution and launching arbitrary system commands.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/01/2026

Suscribirse a Vulnerabilidades