Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1441–1460 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

UnscoredPublished 23 Mar 2025, 13:00 WIB

CVE-2025-0718

Nested Pages < 3.2.13 - Contributor+ Stored XSS

The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-23T06:00:04.552Z. Updated 2025-03-24T18:29:38.820Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 01:29 WIB

Official record

MedPublished 23 Mar 2025, 11:31 WIB

CVE-2025-2641

PHPGurukul Art Gallery Management System edit-artist-detail.php sql injection

A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-artist-detail.php?editid=1. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1441 to 1460 of 4001.First page Next page

Published 2025-03-23T04:31:05.696Z. Updated 2025-03-24T12:51:22.650Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 19:51 WIB

Official record

MedPublished 23 Mar 2025, 10:31 WIB

CVE-2025-2640

PHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php sql injection

A vulnerability was found in PHPGurukul Doctor Appointment Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /doctor/appointment-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-23T03:31:05.470Z. Updated 2025-03-24T14:20:02.534Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 21:20 WIB

Official record

MedPublished 23 Mar 2025, 09:31 WIB

CVE-2025-2639

JIZHICMS Article release.html improper authorization

A vulnerability has been found in JIZHICMS up to 1.7.0 and classified as problematic. This vulnerability affects unknown code of the file /user/release.html of the component Article Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-23T02:31:04.017Z. Updated 2025-03-24T14:25:12.626Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 21:25 WIB

Official record

MedPublished 23 Mar 2025, 08:31 WIB

CVE-2025-2638

JIZHICMS Article release.html improper authorization

A vulnerability, which was classified as problematic, was found in JIZHICMS up to 1.7.0. This affects an unknown part of the file /user/release.html of the component Article Handler. The manipulation of the argument ishot with the input 1 leads to improper authorization. It is possible to initiate the attack remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-23T01:31:04.473Z. Updated 2025-03-24T13:59:00.504Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 20:59 WIB

Official record

MedPublished 23 Mar 2025, 07:00 WIB

CVE-2025-2637

JIZHICMS Account Profile Page userinfo.html improper authorization

A vulnerability, which was classified as problematic, has been found in JIZHICMS up to 1.7.0. Affected by this issue is some unknown functionality of the file /user/userinfo.html of the component Account Profile Page. The manipulation of the argument jifen leads to improper authorization. The attack may be launched rem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-23T00:00:09.407Z. Updated 2025-03-24T13:59:38.144Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 20:59 WIB

Official record

MedPublished 23 Mar 2025, 04:31 WIB

CVE-2025-2628

PHPGurukul Art Gallery Management System art-enquiry.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected is an unknown function of the file /art-enquiry.php. The manipulation of the argument eid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T21:31:05.794Z. Updated 2025-03-24T14:00:22.519Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 21:00 WIB

Official record

MedPublished 23 Mar 2025, 04:00 WIB

CVE-2025-2627

PHPGurukul Art Gallery Management System contactus.php sql injection

A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may be initiated remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T21:00:07.866Z. Updated 2025-03-24T14:26:14.522Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 21:26 WIB

Official record

MedPublished 23 Mar 2025, 03:31 WIB

CVE-2025-2626

SourceCodester Kortex Lite Advocate Office Management System edit_case.php sql injection

A vulnerability classified as critical was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This vulnerability affects unknown code of the file edit_case.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T20:31:04.525Z. Updated 2025-03-24T12:53:41.810Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 19:53 WIB

Official record

MedPublished 23 Mar 2025, 03:00 WIB

CVE-2025-2625

westboy CicadasCMS page sql injection

A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /system/cms/content/page. The manipulation of the argument orderField/orderDirection leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T20:00:07.218Z. Updated 2025-03-24T12:54:31.793Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 19:54 WIB

Official record

MedPublished 23 Mar 2025, 02:00 WIB

CVE-2025-2624

westboy CicadasCMS save sql injection

A vulnerability was found in westboy CicadasCMS 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/cms/content/save. The manipulation of the argument content/fujian/laiyuan leads to sql injection. The attack may be launched remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T19:00:13.076Z. Updated 2025-03-24T12:55:42.108Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 19:55 WIB

Official record

MedPublished 23 Mar 2025, 00:31 WIB

CVE-2025-2623

westboy CicadasCMS save cross site scripting

A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross site scripting. The attack can be launched remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T17:31:04.000Z. Updated 2025-03-24T14:28:04.765Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 21:28 WIB

Official record

MedPublished 23 Mar 2025, 00:00 WIB

CVE-2025-2622

aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserialization

A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is possible to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T17:00:17.206Z. Updated 2025-03-24T19:19:27.968Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Mar 2025, 02:19 WIB

Official record

CritPublished 22 Mar 2025, 23:31 WIB

CVE-2025-2621

D-Link DAP-1620 storage check_dws_cookie stack-based overflow

A vulnerability was found in D-Link DAP-1620 1.03 and classified as critical. This issue affects the function check_dws_cookie of the file /storage. The manipulation of the argument uid leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T16:31:05.113Z. Updated 2025-03-24T13:03:44.046Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 20:03 WIB

Official record

CritPublished 22 Mar 2025, 21:31 WIB

CVE-2025-2620

D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow

A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function mod_graph_auth_uri_handler of the file /storage of the component Authentication Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T14:31:05.372Z. Updated 2025-03-24T17:31:40.840Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Mar 2025, 00:31 WIB

Official record

CritPublished 22 Mar 2025, 21:00 WIB

CVE-2025-2619

D-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflow

A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function check_dws_cookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T14:00:08.311Z. Updated 2025-03-24T17:32:29.501Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Mar 2025, 00:32 WIB

Official record

CritPublished 22 Mar 2025, 20:31 WIB

CVE-2025-2618

D-Link DAP-1620 Path api set_ws_action heap-based overflow

A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function set_ws_action of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T13:31:05.548Z. Updated 2025-03-24T17:35:20.659Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Mar 2025, 00:35 WIB

Official record

HighPublished 22 Mar 2025, 19:42 WIB

CVE-2025-2186

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T12:42:11.690Z. Updated 2026-04-08T17:05:23.518Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:05 WIB

Official record

MedPublished 22 Mar 2025, 19:31 WIB

CVE-2025-2617

yangyouwang 杨有旺 crud 简约后台管理系统 Department Page cross site scripting

A vulnerability classified as problematic was found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected by this vulnerability is an unknown functionality of the component Department Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T12:31:08.682Z. Updated 2025-03-24T13:52:11.677Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2025, 20:52 WIB

Official record

UnscoredPublished 22 Mar 2025, 19:23 WIB

CVE-2025-26796

Apache Oozie: XSS in Oozie Web Console

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-22T12:23:19.140Z. Updated 2025-03-24T14:05:19.477Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 21:05 WIB

Official record