Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-42925

Publication date:

31/10/2022

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-42924

Publication date:

31/10/2022

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the &#39;dyn_filter&#39; parameter in the &#39;appLms/ajax.adm_server.php?r=widget/userselector/getusertabledata&#39; function in order to dump the entire database.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-41679

Publication date:

31/10/2022

Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javascript code on the “back_url” parameter in appLms/index.php?modname=faq&op=play function. The exploitation of this vulnerability could allow an attacker to steal the user´s cookies in order to log in to the application.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-41681

Publication date:

31/10/2022

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerability could lead to a remote code injection.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-41680

Publication date:

31/10/2022

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the &#39;search[value] parameter in the appLms/ajax.server.php?r=mycertificate/getMyCertificates&#39; function in order to dump the entire database.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-42923

Publication date:

31/10/2022

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the &#39;id&#39; parameter in the &#39;appCore/index.php?r=adm/mediagallery/delete&#39; function in order to dump the entire database or delete all contents from the &#39;core_user_file&#39; table.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-3499

Publication date:

31/10/2022

An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present.

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2025

CVE-2022-28763

Publication date:

31/10/2022

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-38142

Publication date:

31/10/2022

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-40202

Publication date:

31/10/2022

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication. This function allows the user to designate all function arguments and the file to be executed. This could allow the attacker to start any new process and achieve remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-27583

Publication date:

31/10/2022

A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected firmware version to potentially impact the availability of the FlexiCompact.

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2025

CVE-2022-31690

Publication date:

31/10/2022

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

Subscribe to Vulnerabilities