Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-48417
Publication date:
21/05/2025
The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin interface. The files are located in /etc/ssl (e.g. salia.local.crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates.
Severity CVSS v4.0: Pending analysis
Last modification:
21/05/2025

CVE-2025-48415
Publication date:
21/05/2025
A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor  or perform other administrative actions. Ultimately, this backdoor also allows arbitrary execution of OS commands.
Severity CVSS v4.0: Pending analysis
Last modification:
21/05/2025

CVE-2025-1419
Publication date:
21/05/2025
Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.<br /> <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: LOW
Last modification:
21/05/2025

CVE-2025-1420
Publication date:
21/05/2025
Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.<br /> <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: LOW
Last modification:
21/05/2025

CVE-2025-1421
Publication date:
21/05/2025
Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user&amp;#39;s PC.<br /> <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: LOW
Last modification:
21/05/2025

CVE-2025-40775
Publication date:
21/05/2025
When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure.<br /> This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.
Severity CVSS v4.0: Pending analysis
Last modification:
23/05/2025

CVE-2025-48416
Publication date:
21/05/2025
An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.
Severity CVSS v4.0: Pending analysis
Last modification:
30/05/2025

CVE-2025-1417
Publication date:
21/05/2025
In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of CVE-2025-1416.<br /> <br /> Successful exploitation requires UUID of a targeted backup, which cannot be brute forced. <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: MEDIUM
Last modification:
21/05/2025

CVE-2025-1418
Publication date:
21/05/2025
A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive information (including their usage in connected devices).   <br /> <br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: MEDIUM
Last modification:
21/05/2025

CVE-2025-1416
Publication date:
21/05/2025
In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417.<br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Severity CVSS v4.0: HIGH
Last modification:
21/05/2025

CVE-2025-4221
Publication date:
21/05/2025
The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&amp;#39;s &amp;#39;auto-downloader&amp;#39; shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity CVSS v4.0: Pending analysis
Last modification:
21/05/2025

CVE-2025-4611
Publication date:
21/05/2025
The Slim SEO – Fast &amp; Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&amp;#39;s slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity CVSS v4.0: Pending analysis
Last modification:
21/05/2025
Subscribe to Vulnerabilities