Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates
3,629 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.
CVE-2025-50938
Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-19T19:57:25.078Z.
CVE-2025-51487
A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-20T18:58:58.652Z.
CVE-2025-51488
A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-20T19:00:39.734Z.
CVE-2025-51489
A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-20T19:08:11.138Z.
CVE-2025-51506
In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter. This flaw enables any authenticated user to execute arbitrary SQL queries, via crafted payloads to valueKey to the api/smartlibrary/v2/en/dictionaries/options/lookup endpoint.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-19T20:00:09.130Z.
CVE-2025-51510
MoonShine was discovered to contain a SQL injection vulnerability under the Blog -> Categories page when using the moonshine-tree-resource (version < 2.0.2) component.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-20T19:10:24.940Z.
CVE-2025-51529
Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service (database server resource exhaustion) via unlimited database write operations to the wp_ajax_nopriv_cacsp_insert_consent_data en…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2026-07-05T16:08:37.967Z.
CVE-2025-51539
EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem. The script lacks both …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-19T19:54:24.273Z.
CVE-2025-51540
EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm makes it feasible to re…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-19T19:59:17.703Z.
CVE-2025-51543
An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/reset_password endpoint.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2026-07-05T01:09:27.191Z.
CVE-2025-52337
An authenticated arbitrary file upload vulnerability in the Content Explorer feature of LogicData eCommerce Framework v5.0.9.7000 allows attackers to execute arbitrary code via uploading a crafted file.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-19T20:11:35.929Z.
CVE-2025-52338
An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-19T20:09:50.174Z.
CVE-2025-54336
In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-19T00:00:00.000Z. Updated 2025-08-29T15:10:56.485Z.
Santesoft Sante PACS Server Cross-site Scripting
Sante PACS Server is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webpage and stealing the user's cookie.
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-18T21:26:10.126Z. Updated 2025-08-19T19:22:23.058Z.
Santesoft Sante PACS Server Cross-site Scripting
Sante PACS Server web portal is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webpage and stealing the user's cookie.
Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-18T21:23:42.930Z. Updated 2025-08-19T19:22:39.830Z.
Santesoft Sante PACS Server Cleartext Transmission of Sensitive Information
The Sante PACS Server Web Portal sends credential information without encryption.
Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-18T21:21:38.589Z. Updated 2025-08-19T19:23:01.181Z.
Santesoft Sante PACS Server Double Free
The Sante PACS Server allows a remote attacker to crash the main thread by sending a crafted HL7 message, causing a denial-of-service condition. The application would require a manual restart and no authentication is required.
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-18T21:16:03.614Z. Updated 2025-08-19T19:24:23.617Z.
Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Heap-based Buffer Overflow
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing VC6 files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the…
Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-18T21:11:06.067Z. Updated 2025-08-19T13:27:38.912Z.
Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Heap-based Buffer Overflow
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the …
Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-18T21:09:30.297Z. Updated 2025-08-19T13:28:52.752Z.
Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds Read
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context…
Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-18T21:07:20.484Z. Updated 2025-08-19T13:34:52.678Z.