Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-51397

Publication date:

21/07/2025

A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient&#39; Lists.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-51398

Publication date:

21/07/2025

A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-51400

Publication date:

21/07/2025

A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-51401

Publication date:

21/07/2025

A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-51403

Publication date:

21/07/2025

A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-51396

Publication date:

21/07/2025

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-36106

Publication date:

21/07/2025

IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to view and modify information coming to and from the application which could then be used to access confidential information on the device or network by using a the deprecated or misconfigured AFNetworking library at runtime.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2020-26799

Publication date:

21/07/2025

A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users&#39; data.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2025

CVE-2025-36057

Publication date:

21/07/2025

IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 <br /> <br /> is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-36062

Publication date:

21/07/2025

IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 <br /> <br /> could be vulnerable to information exposure due to the use of unencrypted network traffic.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

CVE-2025-52575

Publication date:

21/07/2025

EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2025

CVE-2025-7933

Publication date:

21/07/2025

A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/settings_update.php of the component Setting Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

23/07/2025

Subscribe to Vulnerabilities