Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24795

Publication date:

13/12/2021

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2021

CVE-2021-24818

Publication date:

13/12/2021

The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2021

CVE-2021-24817

Publication date:

13/12/2021

The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2021

CVE-2021-24819

Publication date:

13/12/2021

The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2021

CVE-2021-24845

Publication date:

13/12/2021

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2022

CVE-2021-24836

Publication date:

13/12/2021

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2022

CVE-2021-24790

Publication date:

13/12/2021

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2022

CVE-2021-24747

Publication date:

13/12/2021

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST[&#39;order&#39;][0][&#39;dir&#39;] parameter is not properly escaped leading to blind and error-based SQL injections.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2022

CVE-2021-20867

Publication date:

13/12/2021

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-20865

Publication date:

13/12/2021

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-20866

Publication date:

13/12/2021

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2021

CVE-2021-44155

Publication date:

13/12/2021

An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

Subscribe to Vulnerabilities