Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-22919

Publication date:

01/05/2023

The post-authentication command injection vulnerability in the Zyxel NBG6604 firmware version V1.01(ABIR.0)C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2023

CVE-2023-22921

Publication date:

01/05/2023

A cross-site scripting (XSS) vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to store malicious scripts using a web management interface parameter, resulting in denial-of-service (DoS) conditions on an affected device.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2023

CVE-2023-22922

Publication date:

01/05/2023

A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote unauthenticated attacker to cause DoS conditions by sending crafted packets if Telnet is enabled on a vulnerable device.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2023

CVE-2023-22924

Publication date:

01/05/2023

A buffer overflow vulnerability in the Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.14)C0 could allow a remote authenticated attacker with administrator privileges to cause denial-of-service (DoS) conditions by executing crafted CLI commands on a vulnerable device.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2023

CVE-2023-22503

Publication date:

01/05/2023

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature.<br /> <br /> This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team.<br /> <br /> The affected versions are before version 7.13.15, from version 7.14.0 before 7.19.7, and from version 7.20.0 before 8.2.0.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2023-29643

Publication date:

01/05/2023

Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2025

CVE-2023-2451

Publication date:

01/05/2023

A vulnerability was found in SourceCodester Online DJ Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/bookings/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227795.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

CVE-2023-29635

Publication date:

01/05/2023

File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2025

CVE-2023-29637

Publication date:

01/05/2023

Cross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML via editing the article content in the "article editor" page.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2025

CVE-2023-29641

Publication date:

01/05/2023

Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2025

CVE-2023-29638

Publication date:

01/05/2023

Cross Site Scripting (XSS) vulnerability in WinterChenS my-site before commit 3f0423da6d5200c7a46e200da145c1f54ee18548, allows attackers to inject arbitrary web script or HTML via editing blog articles.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2025

CVE-2023-29636

Publication date:

01/05/2023

Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" field in the "blog management" page due to the the default configuration not using MyBlogUtils.cleanString.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2026

Subscribe to Vulnerabilities