Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2981–3000 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

HighPublished 07 Aug 2025, 07:02 WIB

CVE-2025-54882

Himmelblau's Kerberos credential cache collection is world readable

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world rea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:02:09.263Z. Updated 2025-08-07T14:32:00.582Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated07 Aug 2025, 21:32 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-40992

CVE-2023-40992

Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T20:36:08.993Z.

Showing 2981 to 3000 of 3629.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 03:36 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41519

CVE-2023-41519

Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T20:36:49.960Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 03:36 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41520

CVE-2023-41520

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmName parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T20:04:10.961Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 03:04 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41521

CVE-2023-41521

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessionName parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T20:10:20.627Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 03:10 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41522

CVE-2023-41522

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, firstname, and admissionNumber parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T15:37:58.053Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 22:37 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41523

CVE-2023-41523

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T16:10:38.408Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 23:10 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41524

CVE-2023-41524

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T15:40:15.811Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 22:40 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41525

CVE-2023-41525

Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T13:44:31.212Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 20:44 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41526

CVE-2023-41526

Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T13:52:15.131Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 20:52 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41527

CVE-2023-41527

Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T14:11:26.728Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 21:11 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41528

CVE-2023-41528

Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T14:12:36.076Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 21:12 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41529

CVE-2023-41529

Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T19:09:31.742Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 02:09 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41530

CVE-2023-41530

Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-08T14:13:42.842Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 21:13 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41531

CVE-2023-41531

Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2 parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T19:17:02.815Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 02:17 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2023-41532

CVE-2023-41532

Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T19:18:32.327Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 02:18 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2024-42048

CVE-2024-42048

OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users to write to the installation path. In combination with the application's behavior of loading DLLs from this location, this allows for DLL hijacking and may result in arbitrary cod…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-29T19:35:04.557Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2025, 02:35 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2024-52680

CVE-2024-52680

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2026-07-05T01:06:20.684Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:06 WIB

Official record

UnscoredPublished 07 Aug 2025, 07:00 WIB

CVE-2024-55401

CVE-2024-55401

An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2026-07-05T01:06:32.659Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:06 WIB

Official record

MedPublished 07 Aug 2025, 07:00 WIB

CVE-2025-32094

CVE-2025-32094

An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the reque…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:00:00.000Z. Updated 2025-08-07T14:40:00.471Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated07 Aug 2025, 21:40 WIB

Official record