Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-17317

Publication date:
07/10/2019
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2022

CVE-2019-17318

Publication date:
07/10/2019
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2019-17319

Publication date:
07/10/2019
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2019-17315

Publication date:
07/10/2019
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2022

CVE-2019-17316

Publication date:
07/10/2019
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2022

CVE-2015-9451

Publication date:
07/10/2019
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
08/10/2019

CVE-2015-9452

Publication date:
07/10/2019
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
15/01/2025

CVE-2015-9450

Publication date:
07/10/2019
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2019

CVE-2019-12811

Publication date:
07/10/2019
ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. This can be leveraged for code execution
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2019

CVE-2015-9456

Publication date:
07/10/2019
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2019

CVE-2015-9455

Publication date:
07/10/2019
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2019

CVE-2015-9454

Publication date:
07/10/2019
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2019