https://vulnogram.org/ Most recent CVEs assigned by Spanish National Cybersecurity Institute, S.A. (INCIBE) (incibe). https://vulnogram.org/seaview/icons/incibe.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-11960 https://vulnogram.org/CVE-2026-11960 Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify… Medium Tue, 20 Oct 2026 08:14:27 GMT https://vulnogram.org/CVE-2026-11959 https://vulnogram.org/CVE-2026-11959 Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerabili… Medium Tue, 20 Oct 2026 08:13:28 GMT https://vulnogram.org/CVE-2026-13695 https://vulnogram.org/CVE-2026-13695 SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could a… High Network Exploitable Mon, 19 Oct 2026 08:37:47 GMT https://vulnogram.org/CVE-2026-112161 https://vulnogram.org/CVE-2026-112161 MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicio… High Mon, 19 Oct 2026 08:19:20 GMT https://vulnogram.org/CVE-2026-101300 https://vulnogram.org/CVE-2026-101300 Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by select… High Fri, 16 Oct 2026 08:56:02 GMT https://vulnogram.org/CVE-2026-111472 https://vulnogram.org/CVE-2026-111472 An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin… Critical Network Exploitable Fri, 16 Oct 2026 08:37:34 GMT https://vulnogram.org/CVE-2026-101287 https://vulnogram.org/CVE-2026-101287 Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process… Critical Network Exploitable Thu, 15 Oct 2026 09:00:07 GMT https://vulnogram.org/CVE-2026-108072 https://vulnogram.org/CVE-2026-108072 Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid sess… Medium Wed, 14 Oct 2026 11:06:15 GMT https://vulnogram.org/CVE-2026-108071 https://vulnogram.org/CVE-2026-108071 Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication… High Wed, 14 Oct 2026 11:02:57 GMT https://vulnogram.org/CVE-2026-108070 https://vulnogram.org/CVE-2026-108070 A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the ac… High Network Exploitable Wed, 14 Oct 2026 10:54:58 GMT https://vulnogram.org/CVE-2026-14851 https://vulnogram.org/CVE-2026-14851 A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment… Critical Network Exploitable Wed, 14 Oct 2026 08:23:26 GMT https://vulnogram.org/CVE-2026-96535 https://vulnogram.org/CVE-2026-96535 Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing… Medium Tue, 13 Oct 2026 08:41:05 GMT https://vulnogram.org/CVE-2026-4264 https://vulnogram.org/CVE-2026-4264 Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. Wh… Medium Network Exploitable Fri, 09 Oct 2026 07:43:32 GMT https://vulnogram.org/CVE-2026-4894 https://vulnogram.org/CVE-2026-4894 A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup… Medium Network Exploitable Thu, 08 Oct 2026 08:44:19 GMT https://vulnogram.org/CVE-2026-12260 https://vulnogram.org/CVE-2026-12260 SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based an… Critical Network Exploitable Thu, 08 Oct 2026 08:04:59 GMT https://vulnogram.org/CVE-2026-92533 https://vulnogram.org/CVE-2026-92533 Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files lo… High Wed, 07 Oct 2026 10:48:59 GMT https://vulnogram.org/CVE-2026-92532 https://vulnogram.org/CVE-2026-92532 Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the application configuration to store files in a directory accessible via the web interface. Due… High Wed, 07 Oct 2026 10:48:48 GMT https://vulnogram.org/CVE-2026-92531 https://vulnogram.org/CVE-2026-92531 Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authen… High Wed, 07 Oct 2026 10:48:41 GMT https://vulnogram.org/CVE-2026-5703 https://vulnogram.org/CVE-2026-5703 Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the w… High Wed, 07 Oct 2026 08:35:00 GMT https://vulnogram.org/CVE-2026-103831 https://vulnogram.org/CVE-2026-103831 CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data store… High Tue, 06 Oct 2026 10:28:32 GMT https://vulnogram.org/CVE-2026-4889 https://vulnogram.org/CVE-2026-4889 SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfu… High Network Exploitable Tue, 06 Oct 2026 08:16:56 GMT https://vulnogram.org/CVE-2026-59668 https://vulnogram.org/CVE-2026-59668 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoi… Medium Fri, 02 Oct 2026 10:17:56 GMT https://vulnogram.org/CVE-2026-59667 https://vulnogram.org/CVE-2026-59667 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoi… Medium Fri, 02 Oct 2026 10:15:06 GMT https://vulnogram.org/CVE-2026-59666 https://vulnogram.org/CVE-2026-59666 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoi… Medium Fri, 02 Oct 2026 10:12:37 GMT https://vulnogram.org/CVE-2026-59665 https://vulnogram.org/CVE-2026-59665 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomMotivo” parameter is affected – endpoi… Medium Fri, 02 Oct 2026 10:10:18 GMT https://vulnogram.org/CVE-2026-59662 https://vulnogram.org/CVE-2026-59662 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – en… Medium Fri, 02 Oct 2026 10:07:12 GMT https://vulnogram.org/CVE-2026-59664 https://vulnogram.org/CVE-2026-59664 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affecte… Medium Fri, 02 Oct 2026 10:02:54 GMT https://vulnogram.org/CVE-2026-59663 https://vulnogram.org/CVE-2026-59663 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomDelegacion” parameter is affected – en… Medium Fri, 02 Oct 2026 09:58:51 GMT https://vulnogram.org/CVE-2026-95662 https://vulnogram.org/CVE-2026-95662 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – en… Medium Fri, 02 Oct 2026 09:51:31 GMT https://vulnogram.org/CVE-2026-59661 https://vulnogram.org/CVE-2026-59661 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomRuta” parameter is affected – endpoint… Medium Fri, 02 Oct 2026 09:47:27 GMT https://vulnogram.org/CVE-2026-59660 https://vulnogram.org/CVE-2026-59660 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTransportista” parameter is affected –… Medium Fri, 02 Oct 2026 09:43:53 GMT https://vulnogram.org/CVE-2026-59659 https://vulnogram.org/CVE-2026-59659 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomZonaGeo” parameter is affected – endpo… Medium Fri, 02 Oct 2026 09:41:43 GMT https://vulnogram.org/CVE-2026-59673 https://vulnogram.org/CVE-2026-59673 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTipoCli” parameter is affected – endpo… Medium Fri, 02 Oct 2026 09:12:52 GMT https://vulnogram.org/CVE-2026-59672 https://vulnogram.org/CVE-2026-59672 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affecte… Medium Fri, 02 Oct 2026 09:09:29 GMT https://vulnogram.org/CVE-2026-59671 https://vulnogram.org/CVE-2026-59671 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesd… Medium Fri, 02 Oct 2026 09:06:29 GMT https://vulnogram.org/CVE-2026-59670 https://vulnogram.org/CVE-2026-59670 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected… Medium Fri, 02 Oct 2026 09:01:59 GMT https://vulnogram.org/CVE-2026-59669 https://vulnogram.org/CVE-2026-59669 Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/… Medium Fri, 02 Oct 2026 08:40:52 GMT https://vulnogram.org/CVE-2026-7176 https://vulnogram.org/CVE-2026-7176 CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaSc… Medium Thu, 01 Oct 2026 09:54:26 GMT https://vulnogram.org/CVE-2026-7175 https://vulnogram.org/CVE-2026-7175 CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page; Medium Thu, 01 Oct 2026 09:54:19 GMT https://vulnogram.org/CVE-2026-7174 https://vulnogram.org/CVE-2026-7174 CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an eve… Medium Thu, 01 Oct 2026 09:54:10 GMT https://vulnogram.org/CVE-2026-7173 https://vulnogram.org/CVE-2026-7173 CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. * (Stored XSS) The City par… Medium Thu, 01 Oct 2026 09:54:02 GMT https://vulnogram.org/CVE-2026-7192 https://vulnogram.org/CVE-2026-7192 A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_c… Critical Network Exploitable Tue, 29 Sep 2026 12:08:14 GMT https://vulnogram.org/CVE-2026-7193 https://vulnogram.org/CVE-2026-7193 A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gain full root access to the device via the Telnet service (port 23) using static credentials. High Tue, 29 Sep 2026 12:07:12 GMT https://vulnogram.org/CVE-2026-7171 https://vulnogram.org/CVE-2026-7171 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. Successful explo… Medium Mon, 28 Sep 2026 09:50:18 GMT https://vulnogram.org/CVE-2026-7172 https://vulnogram.org/CVE-2026-7172 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=com_virtuemart&page=admin.user_list'. Successful exploitati… Medium Mon, 28 Sep 2026 09:50:16 GMT https://vulnogram.org/CVE-2026-7170 https://vulnogram.org/CVE-2026-7170 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: parameter 'vendor_store_name' in the endpoint '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vend… Medium Mon, 28 Sep 2026 09:49:15 GMT https://vulnogram.org/CVE-2026-6088 https://vulnogram.org/CVE-2026-6088 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaS… Medium Fri, 25 Sep 2026 08:33:06 GMT https://vulnogram.org/CVE-2026-6087 https://vulnogram.org/CVE-2026-6087 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaS… Medium Fri, 25 Sep 2026 08:32:33 GMT https://vulnogram.org/CVE-2026-6086 https://vulnogram.org/CVE-2026-6086 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malici… Medium Fri, 25 Sep 2026 08:31:53 GMT https://vulnogram.org/CVE-2026-6085 https://vulnogram.org/CVE-2026-6085 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malici… Medium Fri, 25 Sep 2026 08:31:21 GMT