Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-24265

Publication date:

31/01/2022

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_filter=3 parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2022

CVE-2022-24266

Publication date:

31/01/2022

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2022

CVE-2022-24263

Publication date:

31/01/2022

Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2022-23872

Publication date:

31/01/2022

Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2022

CVE-2022-21659

Publication date:

31/01/2022

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2025

CVE-2021-46459

Publication date:

31/01/2022

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2022

CVE-2021-42635

Publication date:

31/01/2022

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2022

CVE-2021-42631

Publication date:

31/01/2022

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2022

CVE-2021-44114

Publication date:

31/01/2022

Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows remote malicious users to execute arbitrary remote code execution via create user function.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-46458

Publication date:

31/01/2022

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

19/02/2022

CVE-2022-0286

Publication date:

31/01/2022

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2023

CVE-2021-40033

Publication date:

31/01/2022

There is an information exposure vulnerability on several Huawei Products. The vulnerability is due to that the software does not properly protect certain information. Successful exploit could cause information disclosure. Affected product versions include: CloudEngine 12800 V200R005C10SPC800; CloudEngine 5800 V200R005C10SPC800, V200R019C00SPC800; CloudEngine 6800 V200R005C10SPC800, V200R005C20SPC800, V200R019C00SPC800; CloudEngine 7800 V200R005C10SPC800, V200R019C00SPC800.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2022

Subscribe to Vulnerabilities