Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-49957

Publication date:

07/12/2023

An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. It permits multiple transactions with the same connectorId and idTag, contrary to the expected ConcurrentTx status. This could result in critical transaction management and billing errors. NOTE: the vendor&#39;s perspective is "Imagine you&#39;ve got two cars in your family and want to charge both in parallel on the same account/token? Why should that be rejected?"

Severity CVSS v4.0: Pending analysis

Last modification:

13/12/2023

CVE-2023-49958

Publication date:

07/12/2023

An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is accepted. This could be exploited to alter transaction records or impact system integrity.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2024

CVE-2023-48325

Publication date:

07/12/2023

URL Redirection to Untrusted Site (&#39;Open Redirect&#39;) vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-35039

Publication date:

07/12/2023

Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-35909

Publication date:

07/12/2023

Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-47779

Publication date:

07/12/2023

URL Redirection to Untrusted Site (&#39;Open Redirect&#39;) vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-46641

Publication date:

07/12/2023

Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.24.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-49746

Publication date:

07/12/2023

Server-Side Request Forgery (SSRF) vulnerability in Softaculous Team SpeedyCache – Cache, Optimization, Performance.This issue affects SpeedyCache – Cache, Optimization, Performance: from n/a through 1.1.2.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2022-45362

Publication date:

07/12/2023

Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-41804

Publication date:

07/12/2023

Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

CVE-2023-50164

Publication date:

07/12/2023

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-48860

Publication date:

07/12/2023

TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2023

Subscribe to Vulnerabilities