Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-32595

Publication date:
02/11/2021
Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-23754

Publication date:
02/11/2021
Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-23719

Publication date:
02/11/2021
Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the bbsmeta parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-23718

Publication date:
02/11/2021
Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2021-26107

Publication date:
02/11/2021
An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.
Severity CVSS v4.0: Pending analysis
Last modification:
28/06/2022

CVE-2020-23685

Publication date:
02/11/2021
SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to login.php.
Severity CVSS v4.0: Pending analysis
Last modification:
24/02/2023

CVE-2020-18438

Publication date:
02/11/2021
Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-12814

Publication date:
02/11/2021
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, version 6.4.4 allows attacker to execute unauthorized code or commands via specifically crafted requests to the web GUI.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-15940

Publication date:
02/11/2021
An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2021

CVE-2020-18439

Publication date:
02/11/2021
An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get a shell.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-18440

Publication date:
02/11/2021
Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021

CVE-2020-20657

Publication date:
02/11/2021
Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while trying to connect.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2021