Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 1181–1200 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

HighPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58686

WordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quadlayers Perfect Brands for WooCommerce perfect-woocommerce-brands allows SQL Injection.This issue affects Perfect Brands for WooCommerce: from n/a through <= 3.6.2.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:44.235Z. Updated 2026-05-13T10:38:32.784Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 17:38 WIB

Official record

HighPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58687

WordPress Current Age Plugin Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Current Age Plugin current-age allows Stored XSS.This issue affects Current Age Plugin: from n/a through <= 1.6.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:43.494Z. Updated 2026-05-12T00:55:25.324Z.

Showing 1181 to 1200 of 4319.First page Next page

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:55 WIB

Official record

HighPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58688

WordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Casengo Casengo Live Chat Support the-casengo-chat-widget allows Stored XSS.This issue affects Casengo Live Chat Support: from n/a through <= 2.1.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:42.457Z. Updated 2026-05-13T10:38:43.439Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 17:38 WIB

Official record

MedPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58689

WordPress Tapfiliate Plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tapfiliate Tapfiliate tapfiliate allows Stored XSS.This issue affects Tapfiliate: from n/a through <= 3.2.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:41.078Z. Updated 2026-05-13T10:37:41.528Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 17:37 WIB

Official record

MedPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58691

WordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Genesis Club Lite genesis-club-lite allows Stored XSS.This issue affects Genesis Club Lite: from n/a through <= 1.17.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:39.577Z. Updated 2026-05-12T01:04:11.099Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 08:04 WIB

Official record

HighPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58690

WordPress Doliconnect Plugin <= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ptibogxiv Doliconnect doliconnect allows Stored XSS.This issue affects Doliconnect: from n/a through <= 9.5.7.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:38.377Z. Updated 2026-05-12T00:59:55.980Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:59 WIB

Official record

MedPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58702

WordPress MarketKing Plugin <= 2.0.92 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebWizards MarketKing marketking-multivendor-marketplace-for-woocommerce allows Stored XSS.This issue affects MarketKing: from n/a through <= 2.0.92.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:37.189Z. Updated 2026-05-13T10:39:02.340Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 17:39 WIB

Official record

MedPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58703

WordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skyword Skyword API Plugin skyword-plugin allows Stored XSS.This issue affects Skyword API Plugin: from n/a through <= 2.5.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:36.452Z. Updated 2026-04-28T16:13:46.954Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

MedPublished 23 Sep 2025, 01:22 WIB

CVE-2025-58704

WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through <= 1.2.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:22:35.609Z. Updated 2026-05-12T01:03:57.417Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 08:03 WIB

Official record

MedPublished 23 Sep 2025, 01:02 WIB

CVE-2025-59418

BunnyPad Vulnerable to Buffer Overflow When Opening Files of Size 20MB or Greater

BunnyPad is a note taking software. Prior to version 11.0.27000.0915, opening files greater than or equal to 20MB causes buffer overflow to occur. This issue has been patched in version 11.0.27000.0915. Users who wish not to upgrade should refrain from opening files larger than 10MB.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:02:45.984Z. Updated 2025-09-22T18:21:35.922Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated23 Sep 2025, 01:21 WIB

Official record

MedPublished 23 Sep 2025, 01:02 WIB

CVE-2025-10809

Campcodes Online Learning Management System department.php sql injection

A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. The affected element is an unknown function of the file /admin/department.php. Such manipulation of the argument d leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T18:02:06.971Z. Updated 2025-09-22T18:23:27.412Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 01:23 WIB

Official record

MedPublished 23 Sep 2025, 00:32 WIB

CVE-2025-10808

Campcodes Farm Management System uploadProduct.php sql injection

A weakness has been identified in Campcodes Farm Management System 1.0. Impacted is an unknown function of the file /uploadProduct.php. This manipulation of the argument Type causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T17:32:06.241Z. Updated 2025-10-15T16:01:41.297Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 23:01 WIB

Official record

HighPublished 23 Sep 2025, 00:28 WIB

CVE-2025-59420

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T17:28:53.869Z. Updated 2025-11-03T17:45:19.901Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 00:45 WIB

Official record

MedPublished 23 Sep 2025, 00:02 WIB

CVE-2025-10807

Campcodes Online Beauty Parlor Management System edit-customer-detailed.php sql injection

A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/edit-customer-detailed.php. The manipulation of the argument editid results in sql injection. The attack may be launched remotely. The exploit has been released to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T17:02:07.877Z. Updated 2025-09-23T13:50:42.071Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:50 WIB

Official record

MedPublished 22 Sep 2025, 23:32 WIB

CVE-2025-10806

Campcodes Online Beauty Parlor Management System bwdates-reports-details.php sql injection

A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remotely. The exploit is publicly available…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T16:32:06.381Z. Updated 2025-09-23T13:51:18.135Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:51 WIB

Official record

MedPublished 22 Sep 2025, 23:17 WIB

CVE-2025-43807

CVE-2025-43807

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T16:17:24.009Z. Updated 2025-09-22T17:26:21.976Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:26 WIB

Official record

MedPublished 22 Sep 2025, 23:15 WIB

CVE-2025-59413

CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T16:15:00.351Z. Updated 2025-09-22T17:26:29.173Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:26 WIB

Official record

MedPublished 22 Sep 2025, 23:14 WIB

CVE-2025-59412

CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the inj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T16:14:44.152Z. Updated 2025-09-22T17:26:36.393Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:26 WIB

Official record

MedPublished 22 Sep 2025, 23:14 WIB

CVE-2025-59411

CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry

CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being esca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T16:14:23.843Z. Updated 2025-09-22T17:26:43.827Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:26 WIB

Official record

HighPublished 22 Sep 2025, 23:13 WIB

CVE-2025-59335

CubeCart Session Not Invalidated After Password Change

CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-22T16:13:23.838Z. Updated 2025-09-22T17:26:51.453Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated23 Sep 2025, 00:26 WIB

Official record