Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-5938

Publication date:

02/07/2024

The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme&#39;s Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2024

CVE-2024-37763

Publication date:

01/07/2024

MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-37764

Publication date:

01/07/2024

MachForm up to version 19 is affected by an authenticated stored cross-site scripting.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-37765

Publication date:

01/07/2024

Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-39309

Publication date:

01/07/2024

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2024

CVE-2024-39310

Publication date:

01/07/2024

The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2024

CVE-2024-39313

Publication date:

01/07/2024

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.

Severity CVSS v4.0: Pending analysis

Last modification:

06/03/2025

CVE-2024-39314

Publication date:

01/07/2024

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2024

CVE-2024-23736

Publication date:

01/07/2024

Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user&#39;s S/MIME certificate of PGP key via malicious link or email.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2024

CVE-2024-23737

Publication date:

01/07/2024

Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user&#39;s S/MIME certificate of PGP key via malicious link or email.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2024-37762

Publication date:

01/07/2024

MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-38367

Publication date:

01/07/2024

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.

Severity CVSS v4.0: Pending analysis

Last modification:

18/09/2024

Subscribe to Vulnerabilities