Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-10968

Publication date:

07/11/2025

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection.This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-12853

Publication date:

07/11/2025

A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Severity CVSS v4.0: MEDIUM

Last modification:

18/11/2025

CVE-2025-10870

Publication date:

07/11/2025

SQL injection vulnerability in DIAL&#39;s CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the &#39;ultralogin&#39; parameter in &#39;/centrosnet/ultralogin.php&#39;.

Severity CVSS v4.0: CRITICAL

Last modification:

12/11/2025

CVE-2025-46413

Publication date:

07/11/2025

Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router &#39;WSR-1800AX4 series&#39;. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacker.

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

CVE-2025-10966

Publication date:

07/11/2025

curl&#39;s code for managing SSH connections when SFTP was done using the wolfSSH<br /> powered backend was flawed and missed host verification mechanisms.<br /> <br /> This prevents curl from detecting MITM attackers and more.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-12520

Publication date:

07/11/2025

The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-12527

Publication date:

07/11/2025

The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the &#39;yydev_notes_save_dashboard_data&#39; function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-64343

Publication date:

07/11/2025

(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authenticated users. Any logged in user can make modifications during the installation for both single-user and all-user installations. This constitutes a local attack vector if the installation is in a directory local users have access to. For single-user installations in a shared directory, these permissions persist after the installation. This issue is fixed in version 3.13.0.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-64346

Publication date:

07/11/2025

archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1.

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

CVE-2025-64339

Publication date:

07/11/2025

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML/JavaScript code, which is rendered unescaped on playlist detail and listing pages. This results in arbitrary JavaScript execution in every viewer’s browser, including administrators. This issue is fixed in version 5.5.2-#147.

Severity CVSS v4.0: HIGH

Last modification:

26/11/2025

CVE-2025-64338

Publication date:

07/11/2025

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, therefore allowing an attacker to target administrators and perform actions with elevated privileges. This issue is fixed in version 5.5.2 - #157.

Severity CVSS v4.0: MEDIUM

Last modification:

31/12/2025

CVE-2025-64336

Publication date:

07/11/2025

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or detail pages, it is rendered unsafely in the Admin → Manage Photos section, resulting in JavaScript execution in the administrator’s browser. This issue is fixed in version 5.5.2-#147.

Severity CVSS v4.0: HIGH

Last modification:

05/12/2025

Subscribe to Vulnerabilities