Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-51242

Publication date:

30/10/2024

A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2025

CVE-2024-51243

Publication date:

30/10/2024

The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2024-51419

Publication date:

30/10/2024

Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

CVE-2024-51424

Publication date:

30/10/2024

An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2024

CVE-2024-48271

Publication date:

30/10/2024

D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack.

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2025

CVE-2024-48272

Publication date:

30/10/2024

D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack.

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2025

CVE-2024-10546

Publication date:

30/10/2024

A vulnerability classified as critical was found in open-scratch Teaching ?????? up to 2.7. This vulnerability affects unknown code of the file /api/sys/ng-alain/getDictItemsByTable/ of the component URL Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

01/11/2024

CVE-2024-46531

Publication date:

30/10/2024

phpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter at /index.php.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2024-48202

Publication date:

30/10/2024

icecms

Severity CVSS v4.0: Pending analysis

Last modification:

18/04/2025

CVE-2024-9419

Publication date:

30/10/2024

Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A client using the HP Smart Universal Printing Driver that sends a print job comprised of a malicious XPS file could potentially lead to Remote Code Execution and/or Elevation of Privilege on the PC.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2024-36060

Publication date:

30/10/2024

EnGenius EnStation5-AC A8J-ENS500AC 1.0.0 devices allow blind OS command injection via shell metacharacters in the Ping and Speed Test parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

CVE-2024-37573

Publication date:

30/10/2024

The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.talkatone.vedroid.ui.launcher.OutgoingCallInterceptor component.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

Subscribe to Vulnerabilities