Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-4257

Publication date:

01/12/2022

A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214631.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-37016

Publication date:

01/12/2022

Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-37017

Publication date:

01/12/2022

Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing security controls. This CVE applies narrowly to the Client User Interface Password protection and Policy Import/Export Password protection, if it has been enabled.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-28607

Publication date:

01/12/2022

An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-30528

Publication date:

01/12/2022

SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-1471

Publication date:

01/12/2022

SnakeYaml&#39;s Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml&#39;s SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

Severity CVSS v4.0: Pending analysis

Last modification:

18/06/2025

CVE-2022-3270

Publication date:

01/12/2022

In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-4221

Publication date:

01/12/2022

Improper Neutralization of Special Elements used in an OS Command (&#39;OS Command Injection&#39;) vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-45050

Publication date:

01/12/2022

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim&#39;s browser. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in the vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

09/01/2023

CVE-2022-4246

Publication date:

01/12/2022

A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214623.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2022

CVE-2022-4247

Publication date:

01/12/2022

A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214624.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-4248

Publication date:

01/12/2022

A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBooking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214625 was assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

Subscribe to Vulnerabilities