Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-13291

Publication date:
17/11/2025
A vulnerability was found in Campcodes Supplier Management System 1.0. This affects an unknown part of the file /manufacturer/confirm_order.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Severity CVSS v4.0: MEDIUM
Last modification:
19/11/2025

CVE-2025-13290

Publication date:
17/11/2025
A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
19/11/2025

CVE-2025-13319

Publication date:
17/11/2025
An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input.<br /> <br /> The API is not enabled by default, and a valid API token is required to perform the attack.
Severity CVSS v4.0: Pending analysis
Last modification:
18/11/2025

CVE-2025-58410

Publication date:
17/11/2025
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only.<br /> <br /> This is caused by improper handling of the memory protections for the buffer resource.
Severity CVSS v4.0: Pending analysis
Last modification:
12/01/2026

CVE-2025-13193

Publication date:
17/11/2025
A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
18/11/2025

CVE-2024-46336

Publication date:
17/11/2025
kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2025

CVE-2024-46334

Publication date:
17/11/2025
kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2025

CVE-2024-44652

Publication date:
17/11/2025
Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_firstname, user_lastname, and user_address parameters in user_register.php.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2025

CVE-2024-44648

Publication date:
17/11/2025
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2025

CVE-2024-44647

Publication date:
17/11/2025
PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2025

CVE-2024-44644

Publication date:
17/11/2025
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2025

CVE-2024-44641

Publication date:
17/11/2025
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the oldpass parameter in change-password.php.
Severity CVSS v4.0: Pending analysis
Last modification:
19/11/2025