Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-48079

Publication date:

02/02/2023

Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2022-46815

Publication date:

02/02/2023

Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-45807

Publication date:

02/02/2023

Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-45067

Publication date:

02/02/2023

Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-40692

Publication date:

02/02/2023

Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-44585

Publication date:

02/02/2023

Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-3560

Publication date:

02/02/2023

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the &#39;pesign&#39; group. However, the script doesn&#39;t check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2022-36401

Publication date:

02/02/2023

Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-23119

Publication date:

02/02/2023

The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2023-23120

Publication date:

02/02/2023

The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

CVE-2023-0651

Publication date:

02/02/2023

A vulnerability was found in FastCMS 0.1.0. It has been classified as critical. Affected is an unknown function of the component Template Management. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: Pending analysis

Last modification:

12/09/2024

CVE-2023-23110

Publication date:

02/02/2023

An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the checksum verification. This affects WNR612v2 Wireless Routers 1.0.0.3 and earlier, DGN1000v3 Modem Router 1.0.0.22 and earlier, D6100 WiFi DSL Modem Routers 1.0.0.63 and earlier, WNR1000v2 Wireless Routers 1.1.2.60 and earlier, XAVN2001v2 Wireless-N Extenders 0.4.0.7 and earlier, WNR2200 Wireless Routers 1.0.1.102 and earlier, WNR2500 Wireless Routers 1.0.0.34 and earlier, R8900 Smart WiFi Routers 1.0.3.6 and earlier, and R9000 Smart WiFi Routers 1.0.3.6 and earlier.

Severity CVSS v4.0: Pending analysis

Last modification:

26/03/2025

Subscribe to Vulnerabilities