Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-37154

Publication date:

07/02/2026

eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the &#39;id&#39; parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37155

Publication date:

07/02/2026

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated &#39;A&#39; characters to trigger an application crash without requiring additional interaction.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37157

Publication date:

07/02/2026

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by accessing the /tmpfs/config_backup.bin resource.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37159

Publication date:

07/02/2026

Parallaxis Cuckoo Clock 5.0 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory registers in the alarm scheduling feature. Attackers can craft a malicious payload exceeding 260 bytes to overwrite EIP and EBP, enabling shellcode execution with potential remote code execution.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37106

Publication date:

07/02/2026

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with administrative access parameters.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37107

Publication date:

07/02/2026

Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field with a large buffer. Attackers can create a text file with 20,000 repeated characters and paste it into the account field to cause the application to become unresponsive and require reinstallation.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37109

Publication date:

07/02/2026

aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Subject title field with a large buffer. Attackers can generate a 1000-character buffer and paste it into the Subject title to trigger an application crash and potential instability.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37122

Publication date:

07/02/2026

SpotFTP-FTP Password Recover 2.4.8 contains a denial of service vulnerability that allows attackers to crash the application by generating a large buffer overflow. Attackers can create a text file with 1000 &#39;Z&#39; characters and input it as a registration code to trigger the application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37135

Publication date:

07/02/2026

AMSS++ 4.7 contains an authentication bypass vulnerability that allows attackers to access administrative accounts using hardcoded credentials. Attackers can log in with the default admin username and password &#39;1234&#39; to gain unauthorized administrative access to the system.

Severity CVSS v4.0: CRITICAL

Last modification:

07/02/2026

CVE-2020-37141

Publication date:

07/02/2026

AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module&#39;s maildetail.php script through the &#39;id&#39; parameter. Attackers can manipulate the &#39;id&#39; parameter in /modules/mail/main/maildetail.php to inject malicious SQL queries and potentially access or modify database contents.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37079

Publication date:

07/02/2026

Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37095

Publication date:

07/02/2026

Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) memory. Attackers can craft a malicious input in the &#39;Cyberoam Server Address&#39; field to trigger a bind TCP shell on port 1337 with system-level access.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

Subscribe to Vulnerabilities