Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18952
Publication date:
05/11/2018
JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2018

CVE-2018-18939
Publication date:
05/11/2018
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field.
Severity CVSS v4.0: Pending analysis
Last modification:
15/11/2018

CVE-2018-18938
Publication date:
05/11/2018
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2025

CVE-2018-18942
Publication date:
05/11/2018
In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2018-18949
Publication date:
05/11/2018
Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2021

CVE-2018-18928
Publication date:
04/11/2018
International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.
Severity CVSS v4.0: Pending analysis
Last modification:
16/01/2019

CVE-2018-18926
Publication date:
04/11/2018
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2019

CVE-2018-18925
Publication date:
04/11/2018
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2019

CVE-2018-18919
Publication date:
04/11/2018
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2018

CVE-2018-18927
Publication date:
04/11/2018
An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2018

CVE-2018-18924
Publication date:
04/11/2018
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message.
Severity CVSS v4.0: Pending analysis
Last modification:
24/08/2020

CVE-2018-18909
Publication date:
03/11/2018
xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2018
Subscribe to Vulnerabilities