Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-31702

Publication date:

17/05/2023

SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.

Severity CVSS v4.0: Pending analysis

Last modification:

22/01/2025

CVE-2023-31703

Publication date:

17/05/2023

Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

22/01/2025

CVE-2023-31903

Publication date:

17/05/2023

GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2025

CVE-2023-31904

Publication date:

17/05/2023

savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion.

Severity CVSS v4.0: Pending analysis

Last modification:

21/01/2025

CVE-2023-30438

Publication date:

17/05/2023

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of arbitrary code in other logical partitions on the same physical server. IBM X-Force ID: 252706.

Severity CVSS v4.0: Pending analysis

Last modification:

25/05/2023

CVE-2023-2679

Publication date:

17/05/2023

Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data.

Severity CVSS v4.0: Pending analysis

Last modification:

25/05/2023

CVE-2023-2756

Publication date:

17/05/2023

SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

Severity CVSS v4.0: Pending analysis

Last modification:

25/05/2023

CVE-2023-2745

Publication date:

17/05/2023

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2023-31208

Publication date:

17/05/2023

Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2024

CVE-2023-2752

Publication date:

17/05/2023

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2023

CVE-2023-2753

Publication date:

17/05/2023

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2023

CVE-2023-0864

Publication date:

17/05/2023

Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

26/05/2023

Subscribe to Vulnerabilities