Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-37171

Publication date:

07/02/2026

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy username configuration that allows local attackers to crash the application. Attackers can overwrite the username field with 10,000 bytes of arbitrary data to trigger an application crash and prevent normal program functionality.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37160

Publication date:

07/02/2026

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37161

Publication date:

07/02/2026

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name field with malicious payload. Attackers can craft a specially designed payload to trigger remote code execution, demonstrating the ability to run system commands like launching the calculator.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37162

Publication date:

07/02/2026

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload of 1608 bytes to trigger a stack-based buffer overflow and execute commands through the registration key field.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37163

Publication date:

07/02/2026

QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the &#39;_located&#39; parameter in the find_matches endpoint. Attackers can inject UNION-based SQL statements to extract database information including user credentials, database name, and system version.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37164

Publication date:

07/02/2026

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license entry field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37165

Publication date:

07/02/2026

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37146

Publication date:

07/02/2026

ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration files. Attackers can access the camera&#39;s configuration backup by sending a GET request to the /config_backup.bin endpoint, exposing credentials and system settings.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37147

Publication date:

07/02/2026

ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through the &#39;id&#39; parameter. Attackers can exploit the vulnerability by injecting malicious SQL code into the &#39;id&#39; parameter of the admin_delete.php script to potentially extract or modify database information.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37154

Publication date:

07/02/2026

eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the &#39;id&#39; parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37155

Publication date:

07/02/2026

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated &#39;A&#39; characters to trigger an application crash without requiring additional interaction.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37157

Publication date:

07/02/2026

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by accessing the /tmpfs/config_backup.bin resource.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

Subscribe to Vulnerabilities