Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-3273
Publication date:
10/07/2023
<br /> Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP<br /> address based on missing access control.<br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
19/07/2023

CVE-2023-3131
Publication date:
10/07/2023
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-3209
Publication date:
10/07/2023
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-3271
Publication date:
10/07/2023
<br /> Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about the system and download data via the REST API by accessing<br /> unauthenticated endpoints.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
19/07/2023

CVE-2023-3219
Publication date:
10/07/2023
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-3045
Publication date:
10/07/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Tise Technology Parking Web Report allows SQL Injection.This issue affects Parking Web Report: before 2.1.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
17/07/2023

CVE-2023-3077
Publication date:
10/07/2023
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins&amp;#39; pro features, and uses the woocommerce-appointments plugin.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-3118
Publication date:
10/07/2023
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Severity CVSS v4.0: Pending analysis
Last modification:
23/04/2025

CVE-2023-3076
Publication date:
10/07/2023
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin&amp;#39;s pro features.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-37151
Publication date:
10/07/2023
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2246. Reason: This candidate is a reservation duplicate of CVE-2023-2246. Notes: All CVE users should reference CVE-2023-2246 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2023-37392
Publication date:
10/07/2023
Cross-Site Request Forgery (CSRF) vulnerability in Deepak Anand WP Dummy Content Generator plugin
Severity CVSS v4.0: Pending analysis
Last modification:
18/07/2023

CVE-2023-36691
Publication date:
10/07/2023
Cross-Site Request Forgery (CSRF) vulnerability in Albert Peschar WebwinkelKeur plugin
Severity CVSS v4.0: Pending analysis
Last modification:
18/07/2023
Subscribe to Vulnerabilities