Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-48112

Publication date:
30/10/2024
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2024-48346

Publication date:
30/10/2024
xtreme1
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024

CVE-2024-48733

Publication date:
30/10/2024
SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-48734

Publication date:
30/10/2024
Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-48735

Publication date:
30/10/2024
Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024

CVE-2024-48807

Publication date:
30/10/2024
Cross Site Scripting vulnerability in PHPGurukul Doctor Appointment Management System v.1.0 allows a local attacker to execute arbitrary code via the search parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
31/03/2025

CVE-2024-51242

Publication date:
30/10/2024
A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF.
Severity CVSS v4.0: Pending analysis
Last modification:
17/05/2025

CVE-2024-51243

Publication date:
30/10/2024
The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.
Severity CVSS v4.0: Pending analysis
Last modification:
06/05/2025

CVE-2024-51419

Publication date:
30/10/2024
Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024

CVE-2024-51424

Publication date:
30/10/2024
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-48271

Publication date:
30/10/2024
D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack.
Severity CVSS v4.0: Pending analysis
Last modification:
07/05/2025

CVE-2024-48272

Publication date:
30/10/2024
D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack.
Severity CVSS v4.0: Pending analysis
Last modification:
07/05/2025