Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-65215

Publication date:

02/12/2025

Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

CVE-2025-65844

Publication date:

02/12/2025

EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.

Severity CVSS v4.0: Pending analysis

Last modification:

06/12/2025

CVE-2025-58386

Publication date:

02/12/2025

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account&#39;s password, effectively taking full control of it.

Severity CVSS v4.0: Pending analysis

Last modification:

04/12/2025

CVE-2025-64750

Publication date:

02/12/2025

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is ineffective. The attacker must cause the user to run a malicious container image that redirects the mount of /proc to the destination of a shared mount, either known to be configured on the target system, or that will be specified by the user when running the container. The attacker must also control the content of the shared mount, for example through another malicious container which also binds it, or as a user with relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5.

Severity CVSS v4.0: Pending analysis

Last modification:

04/12/2025

CVE-2025-65105

Publication date:

02/12/2025

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor: and --security=selinux: which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

CVE-2025-60854

Publication date:

02/12/2025

A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd.

Severity CVSS v4.0: Pending analysis

Last modification:

06/12/2025

CVE-2025-52622

Publication date:

02/12/2025

The BigFix SaaS&#39;s HTTP responses were missing some security headers. The absence of these headers weakens the application&#39;s client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

04/12/2025

CVE-2025-65656

Publication date:

02/12/2025

dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2025

CVE-2025-64070

Publication date:

02/12/2025

Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2025

CVE-2025-65186

Publication date:

02/12/2025

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2025

CVE-2025-65358

Publication date:

02/12/2025

Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the &#39;docid&#39; parameter at /admin/appointment.php.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2025

CVE-2025-13828

Publication date:

02/12/2025

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.<br /> <br /> ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.

Severity CVSS v4.0: CRITICAL

Last modification:

02/12/2025

Subscribe to Vulnerabilities