Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24479

Publication date:

02/08/2021

The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-24478

Publication date:

02/08/2021

The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-24470

Publication date:

02/08/2021

The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-24472

Publication date:

02/08/2021

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2021

CVE-2021-24473

Publication date:

02/08/2021

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and above) to change and delete the profile pictures of other users (including those with higher roles).

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2021

CVE-2021-24477

Publication date:

02/08/2021

The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.

Severity CVSS v4.0: Pending analysis

Last modification:

21/09/2021

CVE-2021-24456

Publication date:

02/08/2021

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard

Severity CVSS v4.0: Pending analysis

Last modification:

09/08/2021

CVE-2021-24448

Publication date:

02/08/2021

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its &#39;Modify default Redirect Delay timer&#39; setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24455

Publication date:

02/08/2021

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-24457

Publication date:

02/08/2021

The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-24464

Publication date:

02/08/2021

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

CVE-2021-24458

Publication date:

02/08/2021

The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2021

Subscribe to Vulnerabilities