Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-34299

Publication date:

07/11/2025

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

Severity CVSS v4.0: CRITICAL

Last modification:

10/12/2025

CVE-2025-12854

Publication date:

07/11/2025

A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The manipulation of the argument userid leads to authorization bypass. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used.

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

CVE-2025-10968

Publication date:

07/11/2025

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection.This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-12853

Publication date:

07/11/2025

A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Severity CVSS v4.0: MEDIUM

Last modification:

18/11/2025

CVE-2025-10870

Publication date:

07/11/2025

SQL injection vulnerability in DIAL&#39;s CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the &#39;ultralogin&#39; parameter in &#39;/centrosnet/ultralogin.php&#39;.

Severity CVSS v4.0: CRITICAL

Last modification:

12/11/2025

CVE-2025-46413

Publication date:

07/11/2025

Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router &#39;WSR-1800AX4 series&#39;. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacker.

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

CVE-2025-10966

Publication date:

07/11/2025

curl&#39;s code for managing SSH connections when SFTP was done using the wolfSSH<br /> powered backend was flawed and missed host verification mechanisms.<br /> <br /> This prevents curl from detecting MITM attackers and more.

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2025-12520

Publication date:

07/11/2025

The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-12527

Publication date:

07/11/2025

The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the &#39;yydev_notes_save_dashboard_data&#39; function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-64343

Publication date:

07/11/2025

(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authenticated users. Any logged in user can make modifications during the installation for both single-user and all-user installations. This constitutes a local attack vector if the installation is in a directory local users have access to. For single-user installations in a shared directory, these permissions persist after the installation. This issue is fixed in version 3.13.0.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-64346

Publication date:

07/11/2025

archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1.

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

CVE-2025-64339

Publication date:

07/11/2025

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML/JavaScript code, which is rendered unescaped on playlist detail and listing pages. This results in arbitrary JavaScript execution in every viewer’s browser, including administrators. This issue is fixed in version 5.5.2-#147.

Severity CVSS v4.0: HIGH

Last modification:

26/11/2025

Subscribe to Vulnerabilities