Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-0733

Publication date:

30/05/2023

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks

Severity CVSS v4.0: Pending analysis

Last modification:

10/01/2025

CVE-2023-0766

Publication date:

30/05/2023

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.

Severity CVSS v4.0: Pending analysis

Last modification:

10/01/2025

CVE-2023-1938

Publication date:

30/05/2023

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue

Severity CVSS v4.0: Pending analysis

Last modification:

10/01/2025

CVE-2023-2113

Publication date:

30/05/2023

The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.

Severity CVSS v4.0: Pending analysis

Last modification:

10/01/2025

CVE-2023-2117

Publication date:

30/05/2023

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.

Severity CVSS v4.0: Pending analysis

Last modification:

10/01/2025

CVE-2023-2111

Publication date:

30/05/2023

The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plugin&#39;s report API endpoint, which could allow administrators in multi-site configuration to leak sensitive information from the site&#39;s database.

Severity CVSS v4.0: Pending analysis

Last modification:

10/01/2025

CVE-2023-1524

Publication date:

30/05/2023

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file&#39;s password.

Severity CVSS v4.0: Pending analysis

Last modification:

21/03/2025

CVE-2023-0329

Publication date:

30/05/2023

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2023-33955

Publication date:

30/05/2023

Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2023

CVE-2023-33191

Publication date:

30/05/2023

Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2023

CVE-2023-33193

Publication date:

30/05/2023

Emby Server is a user-installable home media server which stores and organizes a user&#39;s media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn&#39;t tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2023

CVE-2023-33189

Publication date:

30/05/2023

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2023

Subscribe to Vulnerabilities