Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-18704
Publication date:
29/10/2018
PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
04/12/2018

CVE-2018-18705
Publication date:
29/10/2018
PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php.
Severity CVSS v4.0: Pending analysis
Last modification:
04/12/2018

CVE-2018-18703
Publication date:
29/10/2018
PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserver_filesystem/home.php coninb, consent, contrsh, condrft, or conspam parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
04/12/2018

CVE-2018-18711
Publication date:
29/10/2018
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=edit_info.
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2025

CVE-2018-18702
Publication date:
29/10/2018
spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.
Severity CVSS v4.0: Pending analysis
Last modification:
04/12/2018

CVE-2018-18700
Publication date:
29/10/2018
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
Severity CVSS v4.0: Pending analysis
Last modification:
21/04/2020

CVE-2018-18701
Publication date:
29/10/2018
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
Severity CVSS v4.0: Pending analysis
Last modification:
21/04/2020

CVE-2018-18694
Publication date:
29/10/2018
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.
Severity CVSS v4.0: Pending analysis
Last modification:
06/12/2018

CVE-2018-18699
Publication date:
29/10/2018
An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.
Severity CVSS v4.0: Pending analysis
Last modification:
06/12/2018

CVE-2016-10733
Publication date:
29/10/2018
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
Severity CVSS v4.0: Pending analysis
Last modification:
06/12/2018

CVE-2016-10734
Publication date:
29/10/2018
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
Severity CVSS v4.0: Pending analysis
Last modification:
06/12/2018

CVE-2016-10732
Publication date:
29/10/2018
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
Severity CVSS v4.0: Pending analysis
Last modification:
06/12/2018
Subscribe to Vulnerabilities