Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24960

Publication date:

07/03/2022

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24961

Publication date:

07/03/2022

The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-25038

Publication date:

07/03/2022

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-25039

Publication date:

07/03/2022

The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-25098

Publication date:

07/03/2022

The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2022-0163

Publication date:

07/03/2022

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form&#39;s data, which could include sensitive information such as PII depending on the form.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2022-0205

Publication date:

07/03/2022

The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24216

Publication date:

07/03/2022

The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files&#39; extension, which allows administrators to upload PHP files on their site, even on multisite installations.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24777

Publication date:

07/03/2022

The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24778

Publication date:

07/03/2022

The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022

CVE-2021-24810

Publication date:

07/03/2022

The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2022