Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 1601–1620 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

CritPublished 18 Sep 2025, 18:56 WIB

CVE-2024-13151

SQLi in ESBI Informatics's Auto Service Software

CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ESBI Information and Telecommunication Industry and Trade Limited Company Auto Service Software allows SQL Injection. This issue affects Auto Service Software: before v.2025.10.01.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T11:56:28.863Z. Updated 2026-06-01T12:15:27.058Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:15 WIB

Official record

MedPublished 18 Sep 2025, 18:47 WIB

CVE-2025-40678

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1601 to 1620 of 4319.First page Next page

Published 2025-09-18T11:47:29.812Z. Updated 2025-09-18T13:27:07.847Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:27 WIB

Official record

HighPublished 18 Sep 2025, 18:46 WIB

CVE-2025-40677

SQL injection vulnerability in Summar Software´s Portal del Empleado

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T11:46:31.676Z. Updated 2025-09-18T13:28:42.489Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:28 WIB

Official record

MedPublished 18 Sep 2025, 18:38 WIB

CVE-2024-25011

Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability

Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T11:38:18.371Z. Updated 2025-09-18T13:31:46.260Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:31 WIB

Official record

HighPublished 18 Sep 2025, 18:25 WIB

CVE-2025-10207

Authenticated File Disclosure/Delete

Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T11:25:07.835Z. Updated 2025-09-18T13:32:39.633Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:32 WIB

Official record

HighPublished 18 Sep 2025, 18:17 WIB

CVE-2024-48851

Remote Code Execution

Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This issue affects FLXEON: through 9.3.5.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T11:17:35.712Z. Updated 2025-09-18T13:34:37.756Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:34 WIB

Official record

MedPublished 18 Sep 2025, 18:02 WIB

CVE-2025-10663

PHPGurukul Online Course Registration my-profile.php sql injection

A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T11:02:08.600Z. Updated 2025-09-18T13:36:29.378Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:36 WIB

Official record

MedPublished 18 Sep 2025, 17:32 WIB

CVE-2025-10662

SeaCMS admin_members.php sql injection

A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This affects anothe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T10:32:05.368Z. Updated 2025-09-18T13:39:26.837Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:39 WIB

Official record

HighPublished 18 Sep 2025, 16:31 WIB

CVE-2025-8565

Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it pos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T09:31:29.072Z. Updated 2026-04-08T17:31:35.290Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

MedPublished 18 Sep 2025, 16:31 WIB

CVE-2025-9992

Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Cont…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T09:31:28.275Z. Updated 2026-04-08T17:13:17.041Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:13 WIB

Official record

LowPublished 18 Sep 2025, 16:21 WIB

CVE-2025-30187

Denial of service via crafted DoH exchange in PowerDNS DNSdist

In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T09:21:32.274Z. Updated 2025-11-04T21:09:56.609Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:09 WIB

Official record

MedPublished 18 Sep 2025, 15:59 WIB

CVE-2025-0547

XSS in Mikrogrup's Bizmu

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting (XSS). This issue affects Bizmu: from 2.27.0 through 20250212.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T08:59:04.983Z. Updated 2026-06-06T07:32:59.830Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:32 WIB

Official record

CritPublished 18 Sep 2025, 15:34 WIB

CVE-2025-6237

Path Traversal and Arbitrary File Deletion in invoke-ai/invokeai

A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T08:34:08.039Z. Updated 2025-09-18T13:31:31.235Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:31 WIB

Official record

MedPublished 18 Sep 2025, 13:49 WIB

CVE-2025-10493

Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie

The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T06:49:45.112Z. Updated 2026-04-08T16:40:38.202Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:40 WIB

Official record

UnscoredPublished 18 Sep 2025, 13:11 WIB

CVE-2023-49565

Remote Code Execution

The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T06:11:53.618Z. Updated 2025-09-18T17:56:10.960Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Sep 2025, 00:56 WIB

Official record

UnscoredPublished 18 Sep 2025, 13:10 WIB

CVE-2023-49564

Authentication Bypass

The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid credentials. The root c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T06:10:27.787Z. Updated 2025-09-18T18:01:12.717Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Sep 2025, 01:01 WIB

Official record

UnscoredPublished 18 Sep 2025, 13:00 WIB

CVE-2025-9083

Ninja-forms < 3.11.1 - Unauthenticated PHP Objection

The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T06:00:06.472Z. Updated 2025-09-22T17:27:23.139Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:27 WIB

Official record

UnscoredPublished 18 Sep 2025, 13:00 WIB

CVE-2025-8942

WP Hotel Booking < 2.2.3 - Subscriber+ Rating Manipulation

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T06:00:05.997Z. Updated 2025-09-22T17:27:30.847Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:27 WIB

Official record

UnscoredPublished 18 Sep 2025, 13:00 WIB

CVE-2025-5305

Password Reset with Code < 0.0.17 - Insecure Password Reset Code Creation

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T06:00:04.273Z. Updated 2025-09-22T17:27:38.830Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:27 WIB

Official record

MedPublished 18 Sep 2025, 08:32 WIB

CVE-2025-10642

wangchenyi1996 chat_forum q.php cross site scripting

A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function of the file /q.php. Such manipulation of the argument path leads to cross site scripting. The attack may be launched remotely. This product operates on a rolling release basis, en…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-18T01:32:06.355Z. Updated 2025-09-18T13:17:07.434Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 20:17 WIB

Official record