Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-12563

Publication date:

18/03/2025

The s2Member Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 250214 via the &#39;template&#39; attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2025-30137

Publication date:

18/03/2025

An issue was discovered in the G-Net GNET APK 2.6.2. Hardcoded credentials exist in in APK for ports 9091 and 9092. The GNET mobile application contains hardcoded credentials that provide unauthorized access to the dashcam&#39;s API endpoints on ports 9091 and 9092. Once the GNET SSID is connected to, the attacker sends a crafted authentication command with TibetList and 000000 to list settings of the dashcam at port 9091. There&#39;s a separate set of credentials for port 9092 (stream) that is also exposed in cleartext: admin + tibet. For settings, the required credentials are adim + 000000.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2025

CVE-2025-30138

Publication date:

18/03/2025

An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging Car Battery can be performed by unauthorized persons. It allows unauthorized users to modify critical system settings once connected to its network. Attackers can extract sensitive car and driver information, mute dashcam alerts to prevent detection, disable recording functionality, or even factory reset the device. Additionally, they can disable battery protection, causing the dashcam to drain the car battery when left on overnight. These actions not only compromise privacy but also pose potential physical harm by rendering the dashcam non-functional or causing vehicle battery failure.

Severity CVSS v4.0: Pending analysis

Last modification:

01/07/2025

CVE-2025-30139

Publication date:

18/03/2025

An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam&#39;s network without restriction. Once connected, an attacker can sniff on connected devices such as the user&#39;s smartphone. The SSID is also always broadcasted.

Severity CVSS v4.0: Pending analysis

Last modification:

01/07/2025

CVE-2025-30141

Publication date:

18/03/2025

An issue was discovered on G-Net Dashcam BB GONX devices. One can Remotely Dump Video Footage and the Live Video Stream. It exposes API endpoints on ports 9091 and 9092 that allow remote access to recorded and live video feeds. An attacker who connects to the dashcam&#39;s network can retrieve all stored recordings and convert them from JDR format to MP4. Additionally, port 9092&#39;s RTSP stream can be accessed remotely, allowing real-time video feeds to be extracted without the owner&#39;s knowledge.

Severity CVSS v4.0: Pending analysis

Last modification:

01/07/2025

CVE-2025-30142

Publication date:

18/03/2025

An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the sole mechanism for recognizing paired devices, allowing attackers to bypass authentication. By capturing the MAC address of an already-paired device through ARP scanning or other means, an attacker can spoof the MAC address and connect to the dashcam without going through the pairing process. This enables full access to the device.

Severity CVSS v4.0: Pending analysis

Last modification:

01/07/2025

CVE-2025-29907

Publication date:

18/03/2025

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.

Severity CVSS v4.0: HIGH

Last modification:

22/09/2025

CVE-2025-29930

Publication date:

18/03/2025

imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET[&#39;seoOp&#39;] parameter is manipulated to include malicious input (e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), the application could allow an attacker to read sensitive files on the server (Local File Inclusion, LFI). The $_GET[&#39;seoOp&#39;] and $_GET[&#39;seoArg&#39;] parameters are directly used without sanitization or validation. This is partly mitigated by the fact that the ImpressCMS sensitive files are stored outside the web root, in a folder with a randomized name. The issue has been resolved in imFaq 1.0.1.

Severity CVSS v4.0: MEDIUM

Last modification:

18/03/2025

CVE-2025-27080

Publication date:

18/03/2025

Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, potentially leading to lateral movement involving those services.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2025-29790

Publication date:

18/03/2025

Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.

Severity CVSS v4.0: MEDIUM

Last modification:

04/11/2025

CVE-2025-24801

Publication date:

18/03/2025

GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2025

CVE-2025-25040

Publication date:

18/03/2025

A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: <br /> <br /> - AOS-CX 10.14.xxxx : All patches<br /> - AOS-CX 10.15.xxxx : 10.15.1000 and below <br /> The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

Subscribe to Vulnerabilities