Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1361–1380 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 20 Jul 2025, 16:14 WIB

CVE-2025-7880

Metasoft 美特软件 MetaCRM sendsms.jsp unrestricted upload

A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this issue is some unknown functionality of the file /business/common/sms/sendsms.jsp. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T09:14:05.459Z. Updated 2025-07-21T14:41:54.637Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 21:41 WIB

Official record

MedPublished 20 Jul 2025, 16:02 WIB

CVE-2025-7879

Metasoft 美特软件 MetaCRM mobileupload.jsp unrestricted upload

A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mobileupload.jsp. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1361 to 1380 of 3774.First page Next page

Published 2025-07-20T09:02:05.728Z. Updated 2025-07-21T14:42:27.404Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 21:42 WIB

Official record

MedPublished 20 Jul 2025, 15:32 WIB

CVE-2025-7878

Metasoft 美特软件 MetaCRM upload2.jsp unrestricted upload

A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/upload2.jsp. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T08:32:05.287Z. Updated 2025-07-21T16:49:29.860Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 23:49 WIB

Official record

MedPublished 20 Jul 2025, 15:02 WIB

CVE-2025-7877

Metasoft 美特软件 MetaCRM sendfile.jsp unrestricted upload

A vulnerability, which was classified as critical, has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This issue affects some unknown processing of the file sendfile.jsp. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T08:02:05.225Z. Updated 2025-07-21T17:00:40.872Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 00:00 WIB

Official record

MedPublished 20 Jul 2025, 14:44 WIB

CVE-2025-7876

Metasoft 美特软件 MetaCRM download.jsp AnalyzeParam deserialization

A vulnerability classified as critical was found in Metasoft 美特软件 MetaCRM up to 6.4.2. This vulnerability affects the function AnalyzeParam of the file download.jsp. The manipulation of the argument p leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T07:44:05.111Z. Updated 2025-07-21T17:02:02.458Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 00:02 WIB

Official record

MedPublished 20 Jul 2025, 14:14 WIB

CVE-2025-7875

Metasoft 美特软件 MetaCRM debug.jsp improper authentication

A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T07:14:05.444Z. Updated 2025-07-21T17:03:03.085Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 00:03 WIB

Official record

MedPublished 20 Jul 2025, 14:02 WIB

CVE-2025-7874

Metasoft 美特软件 MetaCRM env.jsp information disclosure

A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /env.jsp. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T07:02:05.244Z. Updated 2025-07-21T17:03:30.422Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 00:03 WIB

Official record

MedPublished 20 Jul 2025, 13:44 WIB

CVE-2025-7873

Metasoft 美特软件 MetaCRM mcc_login.jsp sql injection

A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file mcc_login.jsp. The manipulation of the argument workerid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T06:44:04.946Z. Updated 2025-07-22T13:48:46.655Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:48 WIB

Official record

MedPublished 20 Jul 2025, 13:32 WIB

CVE-2025-7872

Portabilis i-Diario justificativas-de-falta cross site scripting

A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T06:32:05.186Z. Updated 2026-10-09T16:42:54.657Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated09 Oct 2026, 23:42 WIB

Official record

MedPublished 20 Jul 2025, 13:02 WIB

CVE-2025-7871

Portabilis i-Diario conteudos cross site scripting

A security flaw has been discovered in Portabilis i-Diario 1.5.0. The impacted element is an unknown function of the file /conteudos. Performing a manipulation of the argument filter[by_description] results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T06:02:05.813Z. Updated 2026-10-09T16:41:20.873Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated09 Oct 2026, 23:41 WIB

Official record

MedPublished 20 Jul 2025, 12:32 WIB

CVE-2025-7870

Portabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scripting

A vulnerability was identified in Portabilis i-Diario 1.5.0. The affected element is an unknown function of the file app/uploaders/doc_uploader.rb of the component justificativas-de-falta Endpoint. Such manipulation of the argument Anexo leads to cross site scripting. The attack can be launched remotely. The exploit is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T05:32:06.300Z. Updated 2026-10-09T16:38:36.888Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated09 Oct 2026, 23:38 WIB

Official record

MedPublished 20 Jul 2025, 12:02 WIB

CVE-2025-7869

Portabilis i-Educar Turma Module educar_turma_tipo_det.php cross site scripting

A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educar_turma_tipo_det.php?cod_turma_tipo=ID of the component Turma Module. The manipulation of the argument nm_tipo leads to cross site scripting. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T05:02:05.567Z. Updated 2025-07-22T13:38:29.678Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:38 WIB

Official record

MedPublished 20 Jul 2025, 11:32 WIB

CVE-2025-7868

Portabilis i-Educar Calendar educar_calendario_dia_motivo_cad.php cross site scripting

A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to launch the attack remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T04:32:05.817Z. Updated 2025-09-16T20:16:06.829Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated17 Sep 2025, 03:16 WIB

Official record

MedPublished 20 Jul 2025, 11:02 WIB

CVE-2025-7867

Portabilis i-Educar Agenda agenda.php cross site scripting

A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novo_titulo/novo_descricao leads to cross site scripting. It is possible to initiate the attack remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T04:02:05.977Z. Updated 2025-08-19T05:47:19.745Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated19 Aug 2025, 12:47 WIB

Official record

MedPublished 20 Jul 2025, 10:32 WIB

CVE-2025-7866

Portabilis i-Educar Disabilities Module educar_deficiencia_lst.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educar_deficiencia_lst.php of the component Disabilities Module. The manipulation of the argument Deficiência ou Transtorno leads to cross site scripting. The attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T03:32:05.497Z. Updated 2025-07-21T14:54:19.698Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 21:54 WIB

Official record

MedPublished 20 Jul 2025, 10:02 WIB

CVE-2025-7865

thinkgem JeeSite XSS Filter EncodeUtils.java xssFilter cross site scripting

A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Filter. The manipulation of the argument text leads to cross site scripting. The att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T03:02:06.375Z. Updated 2025-07-21T18:38:38.930Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 01:38 WIB

Official record

MedPublished 20 Jul 2025, 09:44 WIB

CVE-2025-7864

thinkgem JeeSite FileUploadController.java upload unrestricted upload

A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been classified as critical. This affects the function Upload of the file src/main/java/com/jeesite/modules/file/web/FileUploadController.java. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T02:44:05.934Z. Updated 2025-07-21T18:38:44.498Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 01:38 WIB

Official record

MedPublished 20 Jul 2025, 09:14 WIB

CVE-2025-7863

thinkgem JeeSite ServletUtils.java redirectUrl

A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the argument url leads to open redirect. The attack may be launched remotely. The name…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T02:14:06.422Z. Updated 2025-07-22T14:12:16.255Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 21:12 WIB

Official record

MedPublished 20 Jul 2025, 09:02 WIB

CVE-2025-7862

TOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authentication

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to missing authentication. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-20T02:02:08.415Z. Updated 2025-07-22T14:14:27.289Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 21:14 WIB

Official record

CritKEVPublished 20 Jul 2025, 08:06 WIB

CVE-2025-53770

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-07-20T01:06:33.607Z. Updated 2026-08-04T03:55:52.588Z.

CVSS9.8v3.1KEVListedEPSSPresentUpdated04 Aug 2026, 10:55 WIB

Official record