Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-52066

Publication date:
30/10/2024
http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-43382

Publication date:
30/10/2024
Snowflake JDBC driver versions >= 3.2.6 and
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2025

CVE-2024-48093

Publication date:
30/10/2024
Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024

CVE-2024-48112

Publication date:
30/10/2024
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2024-48346

Publication date:
30/10/2024
xtreme1
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024

CVE-2024-48733

Publication date:
30/10/2024
SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-48734

Publication date:
30/10/2024
Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-48735

Publication date:
30/10/2024
Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024

CVE-2024-48807

Publication date:
30/10/2024
Cross Site Scripting vulnerability in PHPGurukul Doctor Appointment Management System v.1.0 allows a local attacker to execute arbitrary code via the search parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
31/03/2025

CVE-2024-51242

Publication date:
30/10/2024
A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.
Severity CVSS v4.0: Pending analysis
Last modification:
17/05/2025

CVE-2024-51243

Publication date:
30/10/2024
The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.
Severity CVSS v4.0: Pending analysis
Last modification:
06/05/2025

CVE-2024-51419

Publication date:
30/10/2024
Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024