Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-31889

Publication date:
01/04/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor. This issue affects Extensions for Elementor: from n/a through 2.0.40.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31753

Publication date:
01/04/2025
Cross-Site Request Forgery (CSRF) vulnerability in Animesh Kumar Advanced Speed Increaser. This issue affects Advanced Speed Increaser: from n/a through 2.2.1.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31579

Publication date:
01/04/2025
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EXEIdeas International WP AutoKeyword allows SQL Injection. This issue affects WP AutoKeyword: from n/a through 1.0.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31580

Publication date:
01/04/2025
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Ni WooCommerce Product Enquiry: from n/a through 4.1.8.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31594

Publication date:
01/04/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPglob Auto scroll for reading allows Reflected XSS. This issue affects Auto scroll for reading: from n/a through 1.1.4.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31612

Publication date:
01/04/2025
Deserialization of Untrusted Data vulnerability in Sabuj Kundu CBX Poll allows Object Injection. This issue affects CBX Poll: from n/a through 1.2.7.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31619

Publication date:
01/04/2025
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in marcoingraiti Actionwear products sync allows SQL Injection. This issue affects Actionwear products sync: from n/a through 2.3.3.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31628

Publication date:
01/04/2025
Missing Authorization vulnerability in SlicedInvoices Sliced Invoices. This issue affects Sliced Invoices: from n/a through 3.9.4.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31560

Publication date:
01/04/2025
Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system allows Privilege Escalation. This issue affects Salon booking system: from n/a through 10.11.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31561

Publication date:
01/04/2025
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M. Tuhin Ultimate Push Notifications allows SQL Injection. This issue affects Ultimate Push Notifications: from n/a through 1.1.8.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31563

Publication date:
01/04/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vimal Kava AI Search Bar allows Stored XSS. This issue affects AI Search Bar: from n/a through 1.3.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025

CVE-2025-31564

Publication date:
01/04/2025
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One allows Blind SQL Injection. This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through 2.1.7.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2025