Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-4256

Publication date:

21/12/2023

Within tcpreplay&#39;s tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local attacker to initiate a Denial of Service (DoS) attack.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2024

CVE-2023-51048

Publication date:

21/12/2023

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.

Severity CVSS v4.0: Pending analysis

Last modification:

27/12/2023

CVE-2023-51049

Publication date:

21/12/2023

S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_bbsauth parameter at /admin/ajax.php.

Severity CVSS v4.0: Pending analysis

Last modification:

27/12/2023

CVE-2023-45119

Publication date:

21/12/2023

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The &#39;n&#39; parameter of the /update.php?q=quiz resource does not validate the characters received and they are sent unfiltered to the database.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2025

CVE-2023-45116

Publication date:

21/12/2023

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The &#39;demail&#39; parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2025

CVE-2023-45117

Publication date:

21/12/2023

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The &#39;eid&#39; parameter of the /update.php?q=rmquiz resource does not validate the characters received and they are sent unfiltered to the database.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2025

CVE-2023-45118

Publication date:

21/12/2023

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The &#39;fdid&#39; parameter of the /update.php resource does not validate the characters received and they are sent unfiltered to the database.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2025

CVE-2023-45115

Publication date:

21/12/2023

Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The &#39;ch&#39; parameter of the /update.php?q=addqns resource does not validate the characters received and they are sent unfiltered to the database.

Severity CVSS v4.0: Pending analysis

Last modification:

19/05/2025

CVE-2023-7047

Publication date:

21/12/2023

Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. This affects only SQL data sources.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2024

CVE-2023-51442

Publication date:

21/12/2023

Navidrome is an open source web-based music collection server and streamer. A security vulnerability has been identified in navidrome&#39;s subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key "not so secret". The vulnerability can only be exploited on instances that have never been restarted. Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters). This authentication bypass vulnerability potentially affects all instances that don&#39;t protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected). This issue has been patched in version 0.50.2.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2024

CVE-2023-7035

Publication date:

21/12/2023

A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\standard\templates\post.php of the component Setting Handler. The manipulation of the argument sitename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: LOW

Last modification:

29/04/2026

CVE-2023-50826

Publication date:

21/12/2023

Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in Freshlight Lab Menu Image, Icons made easy allows Stored XSS.This issue affects Menu Image, Icons made easy: from n/a through 3.10.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

Subscribe to Vulnerabilities