Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-37165

Publication date:

30/07/2024

Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. This vulnerability is fixed in 3.2.3 and 3.3.0.beta3.

Severity CVSS v4.0: Pending analysis

Last modification:

11/09/2024

CVE-2024-37299

Publication date:

30/07/2024

Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5.

Severity CVSS v4.0: Pending analysis

Last modification:

11/09/2024

CVE-2024-23091

Publication date:

30/07/2024

Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2024-38909

Publication date:

30/07/2024

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2025

CVE-2024-6699

Publication date:

30/07/2024

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection.This issue affects Mikafon MA7: from v3.0 before v3.1.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2024

CVE-2024-7127

Publication date:

30/07/2024

Improper Neutralization of Input During Web Page Generation vulnerability in Stackposts Social Marketing Tool allows Cross-site Scripting (XSS) attack. By submitting the payload in the username during registration, it can be executed later in the application panel. This could lead to the unauthorised acquisition of information (e.g. cookies from a logged-in user). After multiple attempts to contact the vendor we did not receive any answer. Our team has confirmed the existence of this vulnerability. We suppose this issue affects Social Marketing Tool in all versions.

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2024

CVE-2024-41702

Publication date:

30/07/2024

SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;)

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2024

CVE-2024-41701

Publication date:

30/07/2024

AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Severity CVSS v4.0: Pending analysis

Last modification:

30/07/2024

CVE-2024-41924

Publication date:

30/07/2024

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some known vulnerabilities.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2024-7225

Publication date:

30/07/2024

A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /Script/admin/core/update_policy of the component Edit Insurance Policy Page. The manipulation of the argument pname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272805 was assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/08/2024

CVE-2024-7226

Publication date:

30/07/2024

A vulnerability was found in SourceCodester Medicine Tracker System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save_user of the component Password Change Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272806 is the identifier assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

13/08/2024

CVE-2024-41141

Publication date:

30/07/2024

Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the OAuth Management page, an arbitrary script may be executed on the web browser of the other user who accessed the management page.

Severity CVSS v4.0: Pending analysis

Last modification:

06/11/2024

Subscribe to Vulnerabilities