Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-30345

Publication date:

21/03/2025

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2025-30342

Publication date:

21/03/2025

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly encoded when reflected; however, adding attributes to links is possible, which allows the injection of JavaScript via the onmouseover attribute and others. When a user moves the mouse over such a prepared link, JavaScript is executed in that user&#39;s session.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2025-30343

Publication date:

21/03/2025

A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file or folder as a relative or absolute path (e.g., ../../../etc/passwd), the ZIP archive generated for download converts that title into a path. Depending on the extraction tool used by the user, this might overwrite files locally outside of the chosen directory.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2025-30344

Publication date:

21/03/2025

An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system&#39;s response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password (e.g., more than 100 milliseconds).

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2024-50053

Publication date:

21/03/2025

Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2025-2581

Publication date:

21/03/2025

A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM File Handler. The manipulation leads to integer underflow. The attack can be launched remotely. Upgrading to version 0.25.1 is able to address this issue. It is recommended to upgrade the affected component.

Severity CVSS v4.0: MEDIUM

Last modification:

03/11/2025

CVE-2025-26336

Publication date:

21/03/2025

Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX version(s) prior to 3.41.200.202209300499, contain(s) a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2025-2585

Publication date:

21/03/2025

EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-29807

Publication date:

21/03/2025

Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2025

CVE-2025-29814

Publication date:

21/03/2025

Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2025

CVE-2023-28207

Publication date:

21/03/2025

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A plug-in may be able to inherit app permissions and access user data.

Severity CVSS v4.0: Pending analysis

Last modification:

25/03/2025