Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates
4,001 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.
CVE-2025-25382
An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted request.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-20T20:40:37.442Z.
CVE-2025-25614
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-10T19:17:30.257Z.
CVE-2025-25615
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-12T18:43:12.600Z.
CVE-2025-25616
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-12T18:41:58.860Z.
CVE-2025-25620
Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-10T18:47:19.935Z.
CVE-2025-25907
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-11T02:50:39.490Z.
CVE-2025-25908
A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-11T02:48:57.131Z.
CVE-2025-25940
VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-12T18:23:09.300Z.
CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-12T18:20:57.363Z.
CVE-2025-27910
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-12T15:26:25.626Z.
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-11T02:52:25.597Z.
CVE-2025-27924
Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-11T15:51:51.478Z.
CVE-2025-27925
Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-11T13:36:05.354Z.
CVE-2025-27926
In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.
Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-10T00:00:00.000Z. Updated 2025-03-11T13:36:37.534Z.
ftcms edit cross site scripting
A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and…
Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-09T23:31:04.962Z. Updated 2025-03-10T17:24:28.102Z.
ftcms Search ajax_all_lists sql injection
A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the p…
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-09T23:00:06.280Z. Updated 2025-03-10T17:38:58.551Z.
dayrui XunRuiCMS Friendly Links cross site scripting
A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friendly Links Handler. The manipulation of the argument Website Address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disc…
Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-09T22:31:04.299Z. Updated 2025-03-10T17:42:47.572Z.
OpenXE Ticket Bearbeiten Page cross site scripting
A vulnerability was found in OpenXE up to 1.12. It has been declared as problematic. This vulnerability affects unknown code of the component Ticket Bearbeiten Page. The manipulation of the argument Notizen leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public…
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-09T22:00:10.586Z. Updated 2025-03-10T17:52:09.540Z.
Mage AI insecure default initialization of resource
A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult.…
Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-09T20:00:09.867Z. Updated 2025-03-10T17:59:05.752Z.
JoomlaUX JUX Real Estate realties cross site scripting
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-03-09T17:31:03.683Z. Updated 2025-03-10T18:05:16.412Z.