Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 1901–1920 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2023-53938

RockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters

RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute arbitrary JavaScript in vict…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:34.159Z. Updated 2026-04-07T14:07:57.203Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:07 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2023-53936

Cameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creation

Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing session cookies and execut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1901 to 1920 of 5493.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:33.354Z. Updated 2026-04-07T14:07:55.608Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:07 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2023-53935

WBiz Desk 1.2 SQL Injection Vulnerability via ticket.php Parameter

WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed requests to the ticket endpoin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:32.939Z. Updated 2026-04-07T14:07:54.856Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:07 WIB

Official record

HighPublished 19 Dec 2025, 02:53 WIB

CVE-2023-53934

Kentico Xperience <= 12.0.98 GetResource Handler Denial of Service

A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through maliciously constructed requests.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:32.524Z. Updated 2025-12-18T21:47:23.467Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Dec 2025, 04:47 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2023-53738

Kentico Xperience <= 13.0.109 Page Preview Reflected XSS

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers during page preview interactions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:31.326Z. Updated 2025-12-30T14:09:08.889Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2023-53737

Kentico Xperience <= 13.0.101 Localization Application Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. Attackers can execute scripts that could affect multiple parts of the administration interface.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:30.896Z. Updated 2025-12-30T14:09:08.721Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2023-53736

Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:30.487Z. Updated 2025-12-30T14:09:08.558Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2022-50686

Kentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure

An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages. Detailed error messages can expose internal system information and potentially reveal implementation details to unauthorized users.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:30.061Z. Updated 2025-12-30T14:09:08.388Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2022-50685

Kentico Xperience <= 13.0.56 File Upload Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachments or metafiles. Attackers can upload malicious XML files that enable stored XSS, allowing malicious scripts to execute in users' browsers.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:29.551Z. Updated 2025-12-30T14:09:08.221Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2022-50684

Kentico Xperience <= 13.0.71 Form Emails HTML Injection

An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields. Unencoded form values could enable HTML content execution in recipient email clients, potentially compromising email security.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:29.121Z. Updated 2025-12-30T14:09:08.041Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2022-50683

Kentico Xperience <= 13.0.74 Form Configuration Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration. This allows malicious scripts to execute in users' browsers through unvalidated form configuration settings.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:28.675Z. Updated 2025-12-30T14:09:07.856Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2022-50682

Kentico Xperience <= 13.0.79 Routing Engine CRLF Injection

A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine. This could enable header injection and potentially facilitate further web application attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:28.227Z. Updated 2025-12-18T21:47:44.125Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Dec 2025, 04:47 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2022-50681

Kentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich text editor component. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:27.828Z. Updated 2025-12-30T14:09:07.659Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2022-50680

Kentico Xperience <= 13.0.92 Email Marketing Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates. Attackers can exploit this vulnerability to execute malicious scripts that could compromise user browsers and steal sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:27.435Z. Updated 2025-12-30T14:09:07.489Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2021-47712

Kentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability

A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms. The hotfix introduces an additional security layer to prevent hash value reuse and potential exploitation.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:26.971Z. Updated 2025-12-18T21:48:02.746Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Dec 2025, 04:48 WIB

Official record

HighPublished 19 Dec 2025, 02:53 WIB

CVE-2021-47711

Kentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:26.564Z. Updated 2025-12-18T21:48:09.105Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Dec 2025, 04:48 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2020-36891

Kentico Xperience <= 12.0.49 File Upload Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:26.107Z. Updated 2025-12-30T14:09:07.104Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

HighPublished 19 Dec 2025, 02:53 WIB

CVE-2020-36890

Kentico Xperience <= 10 Administrator Access Control Bypass

An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:25.672Z. Updated 2026-08-10T17:54:39.486Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated11 Aug 2026, 00:54 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2020-36889

Kentico Xperience <= 12.0.90 Administration Interface Stored XSS

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names. This allows malicious scripts to execute in users' browsers when administrators view error messages in the administration interface.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:25.212Z. Updated 2025-12-30T14:09:06.921Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 21:09 WIB

Official record

MedPublished 19 Dec 2025, 02:53 WIB

CVE-2019-25230

Kentico Xperience <= 12.0.0 User Widget Information Disclosure

An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget properties dialog. Attackers can exploit this vulnerability to access unauthorized system information without proper access controls.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-18T19:53:24.782Z. Updated 2025-12-27T16:47:33.495Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Dec 2025, 23:47 WIB

Official record