Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24871

Publication date:

13/12/2021

The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2021

CVE-2021-24955

Publication date:

13/12/2021

The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

17/12/2021

CVE-2021-24863

Publication date:

13/12/2021

The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection

Severity CVSS v4.0: Pending analysis

Last modification:

16/01/2026

CVE-2021-24747

Publication date:

13/12/2021

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST[&#39;order&#39;][0][&#39;dir&#39;] parameter is not properly escaped leading to blind and error-based SQL injections.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2022

CVE-2021-24836

Publication date:

13/12/2021

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2021-24780

Publication date:

13/12/2021

The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page (such as private and password protected) via a direct URL

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-24792

Publication date:

13/12/2021

The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2021

CVE-2021-24795

Publication date:

13/12/2021

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2021

CVE-2021-24756

Publication date:

13/12/2021

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-24771

Publication date:

13/12/2021

The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-24784

Publication date:

13/12/2021

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-24782

Publication date:

13/12/2021

The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

Subscribe to Vulnerabilities