Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-43807

Publication date:

22/09/2025

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a publication’s “Name” text field.

Severity CVSS v4.0: MEDIUM

Last modification:

15/12/2025

CVE-2025-10806

Publication date:

22/09/2025

A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Severity CVSS v4.0: MEDIUM

Last modification:

24/09/2025

CVE-2025-10807

Publication date:

22/09/2025

A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/edit-customer-detailed.php. The manipulation of the argument editid results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.

Severity CVSS v4.0: MEDIUM

Last modification:

24/09/2025

CVE-2025-57601

Publication date:

22/09/2025

AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner&#39;s consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2025

CVE-2025-57602

Publication date:

22/09/2025

Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the cloud controller, gain interactive shell access, and pivot into other connected IoT devices. This can lead to remote code execution, information disclosure, and privilege escalation across customer environments.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2025

CVE-2025-57605

Publication date:

22/09/2025

Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their privileges by assigning themselves as admins of other departments. This results in unauthorized privilege escalation across the department

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2025

CVE-2025-57682

Publication date:

22/09/2025

Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution via the "POST /api/file/s3/get-presigned-get-url-proxy" API

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2025

CVE-2025-57430

Publication date:

22/09/2025

Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2025

CVE-2025-57432

Publication date:

22/09/2025

Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manipulate stream settings, including changing video modes and possibly altering device functionality. No credentials or authentication mechanisms are required to interact with the Telnet interface.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2025

CVE-2025-57433

Publication date:

22/09/2025

The 2wcom IP-4c 2.15.5 device&#39;s web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint (/cwi/ajax_request/get_data.php), an authenticated attacker (even with a low-privileged account like guest) can retrieve the hashed passwords for the admin, manager, and guest accounts. This significantly weakens the system&#39;s security posture, as these hashes could be cracked offline, granting attackers administrative access to the device.

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2025

CVE-2025-36037

Publication date:

22/09/2025

IBM webMethods Integration 10.15 and 11.1 <br /> <br /> is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2025

CVE-2025-36202

Publication date:

22/09/2025

IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2025

Subscribe to Vulnerabilities