Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2025-13596

Improper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6

A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns detailed error messages and stack traces to the client. This may expose internal filesystem paths, SQL queries, database connection details, or environment configuration data to remote unauthenticated attackers. This issue allows information gathering and reconnaissance but does not enable direct system compromise.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Atisoluciones
Products
Ciges
CVE-2024-2722

SQL injection vulnerability in the CIGESv2 system

SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2723

SQL injection vulnerability in the CIGESv2 system

SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2724

SQL injection vulnerability in the CIGESv2 system

SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2725

Exposure of Sensitive Information vulnerability in the CIGESv2 system

Information exposure vulnerability in the CIGESv2 system. A remote attacker might be able to access /vendor/composer/installed.json and retrieve all installed packages used by the application.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2726

Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system

Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2727

Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system

HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2
CVE-2024-2728

Information exposure vulnerability in the CIGESv2 system

Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implementation of the TLS protocol.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Atisoluciones Ciges
Products
Ciges Cigesv2