Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-40694
Publication date:
17/11/2022
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2022

CVE-2022-40200
Publication date:
17/11/2022
Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2025

CVE-2022-39181
Publication date:
17/11/2022
<br /> GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS).<br /> Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in<br /> the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a<br /> vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most<br /> common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or emailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby<br /> an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker&amp;#39;s content<br /> back to the victim, the content is executed by the victim&amp;#39;s browser. <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2022-40192
Publication date:
17/11/2022
Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2022

CVE-2022-39179
Publication date:
17/11/2022
<br /> College Management System v1.0 - Authenticated remote code execution.<br /> An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload<br /> .php file that contains malicious code via student.php file.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/04/2025

CVE-2022-39180
Publication date:
17/11/2022
<br /> College Management System v1.0 - SQL Injection (SQLi).<br /> By inserting SQL commands to the username and password fields in the login.php page<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2022-39178
Publication date:
17/11/2022
<br /> Webvendome - webvendome Internal Server IP Disclosure.<br /> Send GET Request to the request which is shown in the picture.<br /> Internal Server IP and Full path disclosure. <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
28/04/2025

CVE-2022-38165
Publication date:
17/11/2022
Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server.
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2022-36786
Publication date:
17/11/2022
DLINK - DSL-224 Post-auth RCE.<br /> DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API.<br /> It is possible to inject a command through this interface that will run with ROOT permissions on the router.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2022-36924
Publication date:
17/11/2022
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
Severity CVSS v4.0: Pending analysis
Last modification:
22/11/2022

CVE-2022-36787
Publication date:
17/11/2022
<br /> webvendome - webvendome SQL Injection.<br /> SQL Injection in the Parameter " DocNumber"<br /> Request :<br /> Get Request :<br /> /webvendome/showfiles.aspx?jobnumber=nullDoc Number=HERE.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
25/10/2023

CVE-2022-36785
Publication date:
17/11/2022
<br /> D-Link – G integrated Access Device4 Information Disclosure &amp; Authorization Bypass.<br /> *Information Disclosure – <br /> file contains a URL with private IP at line 15 "login.asp" A. The<br /> window.location.href = http://192.168.1.1/setupWizard.asp" http://192.168.1.1/setupWizard.asp" ;<br /> "admin" – contains default username value "login.asp" B. While accessing the web interface, the login form at <br /> <br /> *Authorization Bypass – <br /> URL by "setupWizard.asp&amp;#39; while it blocks direct access to – the web interface does not properly validate user identity variables values located at the client side, it is available to access it without a "login_glag" and "login_status" checking browser and to read the admin user credentials for the web interface.<br /> <br /> <br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025
Subscribe to Vulnerabilities