Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-24885

Publication date:

25/10/2021

The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-24514

Publication date:

25/10/2021

The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-24544

Publication date:

25/10/2021

The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin&#39;s settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2021

CVE-2021-24487

Publication date:

25/10/2021

The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its &#39;Default Text to Display if no tips&#39; setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

15/02/2023

CVE-2021-24485

Publication date:

25/10/2021

The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

Severity CVSS v4.0: Pending analysis

Last modification:

09/12/2022

CVE-2021-24653

Publication date:

25/10/2021

The Cookie Bar WordPress plugin before 1.8.9 doesn&#39;t properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2022

CVE-2021-24543

Publication date:

25/10/2021

The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its &#39;Quote String&#39; and &#39;Reply String&#39; settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.

Severity CVSS v4.0: Pending analysis

Last modification:

09/11/2022

CVE-2021-24515

Publication date:

25/10/2021

The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2021

CVE-2021-24779

Publication date:

25/10/2021

The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2022

CVE-2021-24884

Publication date:

25/10/2021

The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like ,,, and.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.

Severity CVSS v4.0: Pending analysis

Last modification:

30/08/2022

CVE-2021-24489

Publication date:

25/10/2021

The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-0941

Publication date:

25/10/2021

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-154177719References: Upstream kernel

Severity CVSS v4.0: Pending analysis

Last modification:

26/10/2021

Subscribe to Vulnerabilities