Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1821–1840 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

CritPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25646

Tabs Mail Carrier 2.5.1 Buffer Overflow via MAIL FROM

Tabs Mail Carrier 2.5.1 contains a buffer overflow vulnerability in the MAIL FROM SMTP command that allows remote attackers to execute arbitrary code by sending a crafted MAIL FROM parameter. Attackers can connect to the SMTP service on port 25 and send a malicious MAIL FROM command with an oversized buffer to overwrit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:16.609Z. Updated 2026-07-15T01:24:04.939Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

MedPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25645

WinAVI iPod 3GP MP4 PSP Converter 4.4.2 Denial of Service

WinAVI iPod/3GP/MP4/PSP Converter 4.4.2 contains a denial of service vulnerability that allows local attackers to crash the application by processing malformed AVI files. Attackers can create a specially crafted AVI file with an oversized buffer and load it through the Convert to iPhone function to trigger an applicati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1821 to 1840 of 6236.First page Next page

Published 2026-03-24T11:27:15.914Z. Updated 2026-03-24T13:00:53.933Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:00 WIB

Official record

MedPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25644

WinMPG Video Convert 9.3.5 Buffer Overflow Local Denial of Service

WinMPG Video Convert 9.3.5 and older versions contain a buffer overflow vulnerability in the registration dialog that allows local attackers to crash the application by supplying oversized input. Attackers can paste a large payload of 6000 bytes into the Name and Registration Code field to trigger a denial of service c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:15.093Z. Updated 2026-03-26T12:42:09.635Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 19:42 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25643

eNdonesia Portal v8.7 SQL Injection via banners.php

eNdonesia Portal v8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the bid parameter. Attackers can send GET requests to banners.php with crafted SQL payloads in the bid parameter to extract sensitive database i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:14.316Z. Updated 2026-07-15T01:24:04.253Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25642

Bootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact Modules

Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can inject SQL payloads into the thread_id parameter of forum-thread.php, the subject parameter of contact-submit.php, the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:13.590Z. Updated 2026-03-24T17:49:23.150Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 00:49 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25641

Netartmedia Vlog System Lastest SQL Injection via email Parameter

Netartmedia Vlog System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to index.php with malicious email values in the forgotten_password module to extract sensitive database…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:12.816Z. Updated 2026-03-24T15:12:03.502Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:12 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25640

Inout Article Base CMS Lastest SQL Injection via portalLogin.php

Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters. Attackers can inject SQL code using XOR-based payloads in GET requests to portalLogin.php to extract sensitive database information or cause denial of ser…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:12.125Z. Updated 2026-03-24T13:45:44.856Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:45 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25639

Matrimony Website Script M-Plus Multiple SQL Injection

Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various POST parameters. Attackers can inject malicious SQL payloads into parameters like txtGender, religion, Fage, and cboCountry across sim…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:11.423Z. Updated 2026-03-24T13:08:12.060Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:08 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25638

Meeplace Business Review Script Lastest SQL Injection via addclick.php

Meeplace Business Review Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the addclick.php endpoint with crafted SQL payloads in the 'id' parameter to extract s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:10.744Z. Updated 2026-03-26T12:39:30.612Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 19:39 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25637

X-NetStat Pro 5.63 Local Buffer Overflow via EggHunter

X-NetStat Pro 5.63 contains a local buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the EIP register through a 264-byte buffer overflow. Attackers can inject shellcode into memory and use an egg hunter technique to locate and execute the payload when the application pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:10.071Z. Updated 2026-03-24T13:25:04.009Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:25 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25636

Zeeways Jobsite CMS Lastest SQL Injection via id Parameter

Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' GET parameter. Attackers can send crafted requests to news_details.php, jobs_details.php, or job_cmp_details.php with malicious 'id' values using GROUP …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:09.305Z. Updated 2026-03-24T17:53:55.551Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated25 Mar 2026, 00:53 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25635

Zeeways Matrimony CMS Lastest SQL Injection via profile_list

Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the profile_list endpoint. Attackers can inject SQL code via the up_cast, s_mother, and s_religion parameters to extract sensitive database information using time-based or er…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:08.618Z. Updated 2026-03-24T15:12:08.631Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:12 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25634

Base64 Decoder 1.1.2 Local Buffer Overflow SEH Egghunter

Base64 Decoder 1.1.2 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overwrite. Attackers can craft a malicious input file that overflows a buffer, overwrites the SEH chain with a POP-POP-RET gadget address, an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:07.919Z. Updated 2026-07-15T01:24:03.563Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25633

AIDA64 Extreme 5.99.4900 SEH Buffer Overflow via EggHunter

AIDA64 Extreme 5.99.4900 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input through the email preferences and report wizard interfaces. Attackers can inject crafted payloads into the Display name field and Load from f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:07.254Z. Updated 2026-10-01T15:19:22.205Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

MedPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25632

phpFileManager 1.7.8 Local File Inclusion via index.php

phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm_current_dir, and filename parameters. Attackers can send GET requests to index.php with crafted parameter values to access sensitive files like /etc/passwd from…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:06.388Z. Updated 2026-03-26T12:38:55.082Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 19:38 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25631

AIDA64 Business 5.99.4900 SEH Buffer Overflow via EggHunter

AIDA64 Business 5.99.4900 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting SEH pointers with malicious shellcode. Attackers can inject egg hunter shellcode through the SMTP display name field in preferences or report wizard funct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:05.659Z. Updated 2026-07-15T01:24:02.887Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25630

PhreeBooks ERP 5.2.3 Arbitrary File Upload via Image Manager

PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows authenticated attackers to upload malicious files by submitting requests to the image upload endpoint. Attackers can upload PHP files through the imgFile parameter to the bizuno/image/manager endpoint and exe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:04.730Z. Updated 2026-07-28T01:46:57.041Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25629

AIDA64 Extreme 5.99.4900 SEH Buffer Overflow via Logging

AIDA64 Extreme 5.99.4900 contains a structured exception handler buffer overflow vulnerability in the logging functionality that allows local attackers to execute arbitrary code by supplying a malicious CSV log file path. Attackers can inject shellcode through the Hardware Monitoring logging preferences to overflow the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:03.898Z. Updated 2026-10-01T15:19:21.627Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

CritPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25628

Download Accelerator Plus DAP 10.0.6.0 SEH Buffer Overflow

Download Accelerator Plus DAP 10.0.6.0 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by crafting malicious URLs. Attackers can create specially crafted URLs with overflowing buffer data that overwrites SEH pointers and executes embedded shel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:03.194Z. Updated 2026-03-24T13:52:16.320Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 20:52 WIB

Official record

HighPublished 24 Mar 2026, 18:27 WIB

CVE-2019-25627

FlexHEX 2.71 Local Buffer Overflow via SEH Unicode

FlexHEX 2.71 contains a local buffer overflow vulnerability in the Stream Name field that allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overflow. Attackers can craft a malicious text file with carefully aligned shellcode and SEH chain pointers, paste the contents in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-24T11:27:02.248Z. Updated 2026-10-01T15:19:20.978Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record