Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-41648

Publication date:

28/10/2022

The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authentication is not enabled by default for DNC communication. This vulnerability may allow an attacker to deny service on the production line, steal sensitive data from the production line, and alter any products created by the production line. Note: CNC machines running the TNC 640 controller require DNC to be enabled for DNC communication to be present.

Severity CVSS v4.0: CRITICAL

Last modification:

13/10/2025

CVE-2022-2474

Publication date:

28/10/2022

Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the same network segment as the controller (even while connected remotely) to access the service and write unauthorized macros to the device.

Severity CVSS v4.0: Pending analysis

Last modification:

02/11/2022

CVE-2022-2475

Publication date:

28/10/2022

Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers outside of the authorized accessible range. This could allow a user to access privileged resources or resources out of context.

Severity CVSS v4.0: Pending analysis

Last modification:

02/11/2022

CVE-2021-36898

Publication date:

28/10/2022

Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2022

CVE-2021-36864

Publication date:

28/10/2022

Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2022

CVE-2022-43170

Publication date:

28/10/2022

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2025

CVE-2022-43169

Publication date:

28/10/2022

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

CVE-2022-43168

Publication date:

28/10/2022

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

CVE-2022-43167

Publication date:

28/10/2022

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add".

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

CVE-2022-43165

Publication date:

28/10/2022

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create".

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

CVE-2022-43166

Publication date:

28/10/2022

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity".

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

CVE-2022-3400

Publication date:

28/10/2022

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template on the vulnerable WordPress website.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

Subscribe to Vulnerabilities