Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-27853

Publication date:

27/09/2022

Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2022-39258

Publication date:

27/09/2022

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.

Severity CVSS v4.0: Pending analysis

Last modification:

29/09/2022

CVE-2022-39256

Publication date:

27/09/2022

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2022

CVE-2022-3298

Publication date:

26/09/2022

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2022

CVE-2022-40099

Publication date:

26/09/2022

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense_category.php.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2025

CVE-2022-40098

Publication date:

26/09/2022

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2025

CVE-2022-40097

Publication date:

26/09/2022

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_currency.php.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2025

CVE-2022-40050

Publication date:

26/09/2022

ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2025

CVE-2022-30004

Publication date:

26/09/2022

Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection..

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2025

CVE-2022-3290

Publication date:

26/09/2022

Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2022

CVE-2022-30003

Publication date:

26/09/2022

Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products containing XSS payloads in the &#39;Product Title&#39; and &#39;Short Description&#39; fields.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2025