Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-12369

Publication date:
09/12/2024
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
Severity CVSS v4.0: Pending analysis
Last modification:
26/01/2026

CVE-2024-53441

Publication date:
09/12/2024
An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.
Severity CVSS v4.0: Pending analysis
Last modification:
12/12/2024

CVE-2024-54938

Publication date:
09/12/2024
A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/uploads.
Severity CVSS v4.0: Pending analysis
Last modification:
24/04/2025

CVE-2024-54923

Publication date:
09/12/2024
A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the department parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2024

CVE-2024-54924

Publication date:
09/12/2024
A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and content parameters.
Severity CVSS v4.0: Pending analysis
Last modification:
11/12/2024

CVE-2024-54925

Publication date:
09/12/2024
A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
12/12/2024

CVE-2024-54927

Publication date:
09/12/2024
Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php.
Severity CVSS v4.0: Pending analysis
Last modification:
24/04/2025

CVE-2024-54928

Publication date:
09/12/2024
kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php,
Severity CVSS v4.0: Pending analysis
Last modification:
24/04/2025

CVE-2024-54931

Publication date:
09/12/2024
A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
24/04/2025

CVE-2024-54932

Publication date:
09/12/2024
Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php.
Severity CVSS v4.0: Pending analysis
Last modification:
24/04/2025

CVE-2024-54934

Publication date:
09/12/2024
Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php.
Severity CVSS v4.0: Pending analysis
Last modification:
24/04/2025

CVE-2024-54918

Publication date:
09/12/2024
Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php.
Severity CVSS v4.0: Pending analysis
Last modification:
12/12/2024