Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-52079

Publication date:

21/10/2025

The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2025-62249

Publication date:

21/10/2025

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

Severity CVSS v4.0: MEDIUM

Last modification:

12/12/2025

CVE-2025-61255

Publication date:

21/10/2025

Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection.

Severity CVSS v4.0: Pending analysis

Last modification:

23/10/2025

CVE-2025-61457

Publication date:

21/10/2025

code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.

Severity CVSS v4.0: Pending analysis

Last modification:

21/10/2025

CVE-2025-56802

Publication date:

21/10/2025

The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier&#39;s position is that material is not hardcoded and is instead randomly generated on each installation of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-56801

Publication date:

21/10/2025

The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier&#39;s position is that material is not hardcoded and is instead randomly generated on each installation of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-56800

Publication date:

21/10/2025

Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable JavaScript property(a.settingsManager.lockScreenPassword), an attacker can patch the return value to bypass authentication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user modified his own instance of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-56799

Publication date:

21/10/2025

Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-8050

Publication date:

21/10/2025

External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. <br /> <br /> The vulnerability could allow a user to access files hosted on the server.<br /> <br /> This issue affects Flipper: 3.1.2.

Severity CVSS v4.0: MEDIUM

Last modification:

28/10/2025

CVE-2025-60427

Publication date:

21/10/2025

LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.

Severity CVSS v4.0: Pending analysis

Last modification:

22/10/2025

CVE-2025-60507

Publication date:

21/10/2025

Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.

Severity CVSS v4.0: Pending analysis

Last modification:

21/10/2025

CVE-2025-60790

Publication date:

21/10/2025

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

Subscribe to Vulnerabilities