Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2121–2140 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

HighPublished 14 Aug 2025, 17:34 WIB

CVE-2025-52728

WordPress Responsive Posts Carousel WordPress Plugin Plugin <= 15.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:34:02.317Z. Updated 2026-04-28T16:13:17.683Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

MedPublished 14 Aug 2025, 17:34 WIB

CVE-2025-52730

WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Stored XSS.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2121 to 2140 of 3629.First page Next page

Published 2025-08-14T10:34:01.776Z. Updated 2026-05-12T00:33:08.735Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:33 WIB

Official record

HighPublished 14 Aug 2025, 17:34 WIB

CVE-2025-52731

WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Arbitrary Content Deletion Vulnerability

Missing Authorization vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:34:01.225Z. Updated 2026-04-28T16:13:17.770Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 14 Aug 2025, 17:34 WIB

CVE-2025-52732

WordPress Google Map Targeting Plugin <= 1.1.6 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 GMap Targeting gmap-targeting allows PHP Local File Inclusion.This issue affects GMap Targeting: from n/a through <= 1.1.6.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:34:00.681Z. Updated 2026-04-28T16:13:17.667Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 14 Aug 2025, 17:34 WIB

CVE-2025-52775

WordPress Project Cost Calculator Plugin <= 1.0.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:34:00.145Z. Updated 2026-04-28T16:13:18.703Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 14 Aug 2025, 17:33 WIB

CVE-2025-52785

WordPress SMM API plugin <= 6.0.31 - Broken Access Control vulnerability

Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:33:59.436Z. Updated 2026-04-28T16:13:19.033Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 14 Aug 2025, 17:33 WIB

CVE-2025-52788

WordPress CaptionPix <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson CaptionPix captionpix allows Reflected XSS.This issue affects CaptionPix: from n/a through <= 1.8.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:33:58.848Z. Updated 2026-05-12T00:33:15.166Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:33 WIB

Official record

HighPublished 14 Aug 2025, 17:33 WIB

CVE-2025-52800

WordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:33:58.298Z. Updated 2026-04-28T16:13:19.018Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 14 Aug 2025, 17:33 WIB

CVE-2025-52801

WordPress TheBooking Plugin <= 1.4.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TheBooking: from n/a through <= 1.4.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:33:57.635Z. Updated 2026-05-12T00:33:23.139Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:33 WIB

Official record

HighPublished 14 Aug 2025, 17:33 WIB

CVE-2025-52806

WordPress JobSearch Plugin < 3.0.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in eyecix JobSearch wp-jobsearch allows PHP Local File Inclusion.This issue affects JobSearch: from n/a through < 3.0.8.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:33:57.075Z. Updated 2026-04-28T16:13:19.463Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 14 Aug 2025, 17:33 WIB

CVE-2025-52820

WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through <= 1.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:33:56.543Z. Updated 2026-04-28T16:13:19.695Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 14 Aug 2025, 17:33 WIB

CVE-2025-52823

WordPress Cube Portfolio Plugin <= 1.16.8 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through <= 1.16.8.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:33:55.958Z. Updated 2026-05-12T00:33:01.257Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:33 WIB

Official record

MedPublished 14 Aug 2025, 17:32 WIB

CVE-2025-8957

Campcodes Online Flight Booking Management System flights.php sql injection

A vulnerability was determined in Campcodes Online Flight Booking Management System 1.0. Affected is an unknown function of the file /flights.php. The manipulation of the argument departure_airport_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:32:09.728Z. Updated 2025-08-14T14:48:46.786Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:48 WIB

Official record

MedPublished 14 Aug 2025, 17:02 WIB

CVE-2025-8956

D-Link DIR‑818L ssdpcgi cgibin getenv command injection

A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:02:06.669Z. Updated 2025-08-14T14:48:53.941Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:48 WIB

Official record

MedPublished 14 Aug 2025, 17:01 WIB

CVE-2025-7761

Reflected XSS in Lepszy BIP

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did not respond in any way…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T10:01:38.710Z. Updated 2025-08-14T14:49:01.373Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:49 WIB

Official record

CritPublished 14 Aug 2025, 16:54 WIB

CVE-2025-8943

Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T09:54:22.531Z. Updated 2025-08-18T16:47:58.906Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 23:47 WIB

Official record

UnscoredPublished 14 Aug 2025, 16:53 WIB

CVE-2025-8047

Multiple Plugins from itayamar - Supply Chain Compromise

The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert marketing security ser…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T09:53:17.108Z. Updated 2025-08-14T14:49:11.501Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:49 WIB

Official record

CritPublished 14 Aug 2025, 16:49 WIB

CVE-2025-55346

Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T09:49:52.293Z. Updated 2025-08-14T15:44:20.060Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated14 Aug 2025, 22:44 WIB

Official record

MedPublished 14 Aug 2025, 16:32 WIB

CVE-2025-8955

PHPGurukul Hospital Management System edit-doctor.php sql injection

A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit-doctor.php. The manipulation of the argument docfees leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T09:32:06.607Z. Updated 2025-08-14T14:49:17.774Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:49 WIB

Official record

HighPublished 14 Aug 2025, 16:08 WIB

CVE-2025-48862

CVE-2025-48862

Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T09:08:01.853Z. Updated 2025-08-14T15:46:38.467Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated14 Aug 2025, 22:46 WIB

Official record