Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-62658
Publication date:
20/10/2025
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44.
Severity CVSS v4.0: HIGH
Last modification:
15/04/2026

CVE-2025-60781
Publication date:
20/10/2025
PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
22/10/2025

CVE-2025-8053
Publication date:
20/10/2025
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low privilege user to interact with the backend API without sufficient privileges.<br /> <br /> This issue affects Flipper: 3.1.2.
Severity CVSS v4.0: LOW
Last modification:
28/10/2025

CVE-2025-8052
Publication date:
20/10/2025
SQL Injection vulnerability in opentext Flipper allows SQL Injection. <br /> <br /> The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor.<br /> <br /> This issue affects Flipper: 3.1.2.
Severity CVSS v4.0: LOW
Last modification:
28/10/2025

CVE-2025-8049
Publication date:
20/10/2025
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low-privilege user to elevate privileges within the application.<br /> <br /> This issue affects Flipper: 3.1.2.
Severity CVSS v4.0: LOW
Last modification:
28/10/2025

CVE-2025-8048
Publication date:
20/10/2025
External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local file<br /> path and then download the specified file from the system by requesting the<br /> stored document ID.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> This issue affects Flipper: 3.1.2.
Severity CVSS v4.0: MEDIUM
Last modification:
28/10/2025

CVE-2025-8051
Publication date:
20/10/2025
Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal. <br /> <br /> The vulnerability could allow a user to access files hosted on the server.<br /> <br /> This issue affects Flipper: 3.1.2.
Severity CVSS v4.0: MEDIUM
Last modification:
28/10/2025

CVE-2025-62527
Publication date:
20/10/2025
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2025

CVE-2025-62528
Publication date:
20/10/2025
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2025

CVE-2025-62522
Publication date:
20/10/2025
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
Severity CVSS v4.0: MEDIUM
Last modification:
15/04/2026

CVE-2025-62697
Publication date:
20/10/2025
Improper Neutralization of Special Elements in Output Used by a Downstream Component (&amp;#39;Injection&amp;#39;) vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39.
Severity CVSS v4.0: HIGH
Last modification:
15/04/2026

CVE-2025-61488
Publication date:
20/10/2025
An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and the imageURL parameter
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026
Subscribe to Vulnerabilities