Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2005-4527
Publication date:
28/12/2005
Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (1) the setLang parameter in index.php and (2) unspecified search module parameters.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4528
Publication date:
28/12/2005
SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4529
Publication date:
28/12/2005
The Chatspot 2.0.0a7 module for phpBB might allow remote attackers to impersonate other users via unknown vectors.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4530
Publication date:
28/12/2005
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Enterprise 3.0 (formerly DoPays) allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters in (1) profile.htm, (2) card.htm, (3) bank.htm, (4) subscriptions.htm, (5) send.htm, (6) request.htm, (7) forgot.htm, (8) escrow.htm, (9) donations.htm, and (10) products.htm.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4532
Publication date:
28/12/2005
scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LD_PRELOAD to modify expected function calls in the setuid application.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4533
Publication date:
28/12/2005
Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via "getopt" style argument specifications, which are not filtered.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-3535
Publication date:
27/12/2005
Buffer overflow in KETM 0.0.6 allows local users to execute arbitrary code via unknown vectors.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-3341
Publication date:
27/12/2005
DHIS tools DNS package (dhis-tools-dns) before 5.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files created by (1) register-q.sh and (2) register-p.sh.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-3343
Publication date:
27/12/2005
tkdiff before 4.1.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4509
Publication date:
23/12/2005
SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4510
Publication date:
23/12/2005
Directory traversal vulnerability in server.np in NetPublish Server 7 allows remote attackers to read arbitrary files via "../" sequences in the template parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026

CVE-2005-4511
Publication date:
23/12/2005
Format string vulnerability in TN3270 Resource Gateway 1.1.0 allows local users to cause a denial of service and possibly execute arbitrary code via format string specifiers in syslog function calls.
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2026
Subscribe to Vulnerabilities