Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24790

Publication date:

13/12/2021

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2022

CVE-2021-24705

Publication date:

13/12/2021

The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24845

Publication date:

13/12/2021

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2022

CVE-2021-20867

Publication date:

13/12/2021

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-20865

Publication date:

13/12/2021

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-20866

Publication date:

13/12/2021

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-40857

Publication date:

13/12/2021

Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.

Severity CVSS v4.0: Pending analysis

Last modification:

31/03/2022

CVE-2021-40858

Publication date:

13/12/2021

Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin password via the fileName=../../etc/passwd substring.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2022

CVE-2021-44153

Publication date:

13/12/2021

An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables, as demonstrated by an ISV demo "C:\Windows\System32\calc.exe" entry. An attacker can exploit this to run a malicious binary on startup, or when triggering the Reread/Restart Servers function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2021-44154

Publication date:

13/12/2021

An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2021-44155

Publication date:

13/12/2021

An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2021-44152

Publication date:

13/12/2021

An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user&#39;s account.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2023

Subscribe to Vulnerabilities