Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 241–260 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 28 Apr 2025, 19:00 WIB

CVE-2025-4019

20120630 Novel-Plus GeneratorController.java genCode missing authentication

A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function genCode of the file novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java. The manipulation leads to missing authentication. It is possi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T12:00:08.208Z. Updated 2025-04-28T18:08:53.606Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 01:08 WIB

Official record

MedPublished 28 Apr 2025, 18:31 WIB

CVE-2025-4018

20120630 Novel-Plus CrawlController.java addCrawlSource missing authentication

A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the function addCrawlSource of the file novel-crawl/src/main/java/com/java2nb/novel/controller/CrawlController.java. The manipulation leads to missing authenticatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 241 to 260 of 4033.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T11:31:05.831Z. Updated 2025-04-28T12:09:41.057Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 19:09 WIB

Official record

MedPublished 28 Apr 2025, 18:00 WIB

CVE-2025-4017

20120630 Novel-Plus LogController.java list improper authorization

A vulnerability classified as problematic was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This vulnerability affects the function list of the file nnovel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper authorization. The attack ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T11:00:08.223Z. Updated 2025-04-28T12:09:30.135Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 19:09 WIB

Official record

MedPublished 28 Apr 2025, 17:31 WIB

CVE-2025-4016

20120630 Novel-Plus LogController.java deleteIndex improper authorization

A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIndex of the file novel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper authorization. It is possible to i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T10:31:05.659Z. Updated 2025-04-28T12:09:17.582Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 19:09 WIB

Official record

MedPublished 28 Apr 2025, 17:00 WIB

CVE-2025-4015

20120630 Novel-Plus SessionController.java list missing authentication

A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. The manipulation leads to missing authentication. The a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T10:00:09.386Z. Updated 2025-04-28T12:10:46.391Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 19:10 WIB

Official record

CritPublished 28 Apr 2025, 16:37 WIB

CVE-2025-3200

Com-Server Exposed via Weak TLS

An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T09:37:02.366Z. Updated 2025-04-28T12:23:31.446Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 19:23 WIB

Official record

MedPublished 28 Apr 2025, 16:31 WIB

CVE-2025-4014

PHPGurukul Art Gallery Management System manage-art-medium.php sql injection

A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/manage-art-medium.php. The manipulation of the argument artmed leads to sql injection. The attack can be launched remotely. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T09:31:06.712Z. Updated 2025-04-28T12:33:22.710Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 19:33 WIB

Official record

LowPublished 28 Apr 2025, 16:11 WIB

CVE-2025-32471

Reuse of salt

The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T09:11:20.143Z. Updated 2026-05-13T12:05:45.996Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 19:05 WIB

Official record

MedPublished 28 Apr 2025, 16:07 WIB

CVE-2025-39367

WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in SeventhQueen Kleo kleo.This issue affects Kleo: from n/a through < 5.4.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T09:07:23.071Z. Updated 2026-04-28T16:12:29.568Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 28 Apr 2025, 16:07 WIB

CVE-2025-32470

Unauthenticated change of IP adress

A remote unauthenticated attacker may be able to change the IP adress of the device, and therefore affecting the availability of the device.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T09:07:02.830Z. Updated 2025-04-28T15:45:46.363Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 22:45 WIB

Official record

MedPublished 28 Apr 2025, 16:00 WIB

CVE-2025-4013

PHPGurukul Art Gallery Management System aboutus.php sql injection

A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T09:00:08.171Z. Updated 2025-04-28T13:12:06.160Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 20:12 WIB

Official record

MedPublished 28 Apr 2025, 15:31 WIB

CVE-2025-4012

playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery

A vulnerability was found in playeduxyz PlayEdu 开源培训系统 up to 1.8 and classified as problematic. This issue affects some unknown processing of the file /api/backend/v1/user/create of the component User Avatar Handler. The manipulation of the argument Avatar leads to server-side request forgery. The attack may be initiat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T08:31:04.539Z. Updated 2025-04-28T15:59:57.756Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 22:59 WIB

Official record

HighPublished 28 Apr 2025, 15:20 WIB

CVE-2025-42598

CVE-2025-42598

Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. If a user is directed to place a crafted DLL file in a location of an attacker's choosing, the attacker may execute arbitrary code with SYSTEM privilege…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T08:20:56.756Z. Updated 2025-04-28T16:10:51.558Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:10 WIB

Official record

MedPublished 28 Apr 2025, 15:00 WIB

CVE-2025-4011

Redmine Custom Query cross site scripting

A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.0.4 is able to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T08:00:11.964Z. Updated 2025-04-28T16:12:33.949Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:12 WIB

Official record

HighPublished 28 Apr 2025, 14:31 WIB

CVE-2025-4007

Tenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflow

A vulnerability classified as critical was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Affected by this vulnerability is the function cgidhcpsCfgSet of the file /goform/modules of the component httpd. The manipulation of the argument json leads to stack-based buffer overflow. The attack can be launched remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T07:31:05.788Z. Updated 2025-04-28T16:16:02.573Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:16 WIB

Official record

HighPublished 28 Apr 2025, 14:10 WIB

CVE-2025-22235

Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T07:10:35.370Z. Updated 2025-05-16T23:03:06.227Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated17 May 2025, 06:03 WIB

Official record

MedPublished 28 Apr 2025, 14:00 WIB

CVE-2025-4006

youyiio BeyongCms Document Management Page Upload.html unrestricted upload

A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the component Document Management Page. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T07:00:08.315Z. Updated 2025-04-28T14:09:50.785Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 21:09 WIB

Official record

MedPublished 28 Apr 2025, 13:31 WIB

CVE-2025-4005

PHPGurukul COVID19 Testing Management System patient-report.php sql injection

A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /patient-report.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T06:31:06.157Z. Updated 2025-04-28T14:10:50.310Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 21:10 WIB

Official record

MedPublished 28 Apr 2025, 13:00 WIB

CVE-2025-4004

PHPGurukul COVID19 Testing Management System password-recovery.php sql injection

A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. The attack can be initiated remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T06:00:07.575Z. Updated 2025-05-02T10:48:11.321Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 May 2025, 17:48 WIB

Official record

UnscoredPublished 28 Apr 2025, 13:00 WIB

CVE-2025-0627

AI Autotagger < 3.30.0 - Admin+ Stored XSS

The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T06:00:02.592Z. Updated 2025-04-28T16:22:58.409Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:22 WIB

Official record