Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2981–3000 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

MedPublished 03 Nov 2025, 04:32 WIB

CVE-2025-12604

itsourcecode Online Loan Management System load_fields.php sql injection

A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation of the argument loan_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-02T21:32:06.054Z. Updated 2025-11-03T14:44:06.472Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 21:44 WIB

Official record

MedPublished 02 Nov 2025, 19:02 WIB

CVE-2025-12598

SourceCodester Best House Rental Management System admin_class.php save_tenant sql injection

A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2981 to 3000 of 3020.First page Next page

Published 2025-11-02T12:02:07.575Z. Updated 2025-11-03T14:44:57.474Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 21:44 WIB

Official record

MedPublished 02 Nov 2025, 18:32 WIB

CVE-2025-12597

SourceCodester Best House Rental Management System admin_class.php save_category sql injection

A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the file /admin_class.php. Performing manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit is now public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-02T11:32:06.558Z. Updated 2025-11-03T14:45:32.495Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 21:45 WIB

Official record

HighPublished 02 Nov 2025, 17:32 WIB

CVE-2025-12596

Tenda AC23 saveParentControlInfo buffer overflow

A security vulnerability has been detected in Tenda AC23 16.03.07.52. Affected is the function saveParentControlInfo of the file /goform/saveParentControlInfo. Such manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-02T10:32:06.299Z. Updated 2026-02-24T06:21:11.086Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:21 WIB

Official record

HighPublished 02 Nov 2025, 17:02 WIB

CVE-2025-12595

Tenda AC23 SetVirtualServerCfg formSetVirtualSer buffer overflow

A weakness has been identified in Tenda AC23 16.03.07.52. This impacts the function formSetVirtualSer of the file /goform/SetVirtualServerCfg. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-02T10:02:07.134Z. Updated 2026-02-24T06:20:56.156Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:20 WIB

Official record

MedPublished 02 Nov 2025, 15:32 WIB

CVE-2025-12594

code-projects Simple Online Hotel Reservation System add_account.php sql injection

A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the file /admin/add_account.php. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit has been released to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-02T08:32:06.189Z. Updated 2026-02-24T06:20:42.777Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:20 WIB

Official record

MedPublished 02 Nov 2025, 13:02 WIB

CVE-2025-12593

code-projects Simple Online Hotel Reservation System Photo edit_room.php unrestricted upload

A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit_room.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-02T06:02:05.981Z. Updated 2026-02-24T06:20:29.609Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:20 WIB

Official record

LowPublished 02 Nov 2025, 01:56 WIB

CVE-2025-12603

/etc/timezone can be Arbitrarily Written

/etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T18:56:52.453Z. Updated 2025-11-03T13:29:31.660Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 20:29 WIB

Official record

LowPublished 02 Nov 2025, 01:54 WIB

CVE-2025-12602

/etc/avahi/services/z9.service can be Arbitrarily Written

/etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T18:54:46.956Z. Updated 2025-11-03T13:29:38.120Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 20:29 WIB

Official record

CritPublished 02 Nov 2025, 01:49 WIB

CVE-2025-12601

Denial of Service Due to SlowLoris

Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T18:49:12.782Z. Updated 2025-11-03T13:29:43.969Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 20:29 WIB

Official record

CritPublished 02 Nov 2025, 01:48 WIB

CVE-2025-12600

Web UI Malfunction

Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T18:48:49.084Z. Updated 2025-11-03T13:29:50.055Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 20:29 WIB

Official record

CritPublished 02 Nov 2025, 01:39 WIB

CVE-2025-12599

Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)

Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T18:39:53.127Z. Updated 2025-11-03T13:29:56.000Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 20:29 WIB

Official record

HighPublished 01 Nov 2025, 19:01 WIB

CVE-2025-36367

IBM i is affected by a privilege escalation in IBM i SQL services

IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use the elevated privileges of another user profile to gain root access to the host operating system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T12:01:31.137Z. Updated 2026-02-26T17:47:40.746Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

MedPublished 01 Nov 2025, 14:30 WIB

CVE-2025-6988

Kallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-le…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T07:30:04.897Z. Updated 2026-04-08T17:05:36.409Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:05 WIB

Official record

HighPublished 01 Nov 2025, 14:30 WIB

CVE-2025-6990

Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution

The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the `TH_PhpCode` pagebuilder widget. This is due to the theme not restricting access to the code editor widget for non-administrators. This makes it possible for authenticated attackers, with Contrib…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T07:30:03.218Z. Updated 2026-04-08T17:00:41.322Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:00 WIB

Official record

MedPublished 01 Nov 2025, 13:40 WIB

CVE-2025-12137

Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read

The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths without proper validation in the 'attach_file()' function when h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T06:40:40.047Z. Updated 2026-04-08T17:32:21.492Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:32 WIB

Official record

HighPublished 01 Nov 2025, 13:40 WIB

CVE-2025-12171

RESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File Upload

The RESTful Content Syndication plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ingest_image() function in versions 1.1.0 to 1.5.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected si…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T06:40:39.565Z. Updated 2025-11-03T13:30:29.197Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated03 Nov 2025, 20:30 WIB

Official record

HighPublished 01 Nov 2025, 13:40 WIB

CVE-2025-11755

Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload

The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T06:40:39.047Z. Updated 2026-04-08T16:56:32.757Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:56 WIB

Official record

HighPublished 01 Nov 2025, 13:40 WIB

CVE-2025-10487

Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. This is due to the endpoint not properly restricting access to the AJAX endpoint or limiting the functions that can be called to safe functions.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T06:40:37.833Z. Updated 2026-04-08T16:48:06.452Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

CritPublished 01 Nov 2025, 13:40 WIB

CVE-2025-11499

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-01T06:40:37.314Z. Updated 2026-04-08T16:43:46.110Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:43 WIB

Official record