Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2261–2280 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

LowPublished 07 Nov 2025, 22:09 WIB

CVE-2025-58465

Download Station

A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T15:09:31.301Z. Updated 2025-11-07T15:47:03.235Z.

CVSS2.2v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 22:47 WIB

Official record

LowPublished 07 Nov 2025, 22:08 WIB

CVE-2025-58469

QuLog Center

A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: QuLog Center 1.8.2.927 ( 2025/09/17 ) and later

Excerpt language: en.

Severity low: primary CNA CVSS 1.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2261 to 2280 of 3020.First page Next page

Published 2025-11-07T15:08:56.159Z. Updated 2025-11-07T15:48:30.618Z.

CVSS1.2v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 22:48 WIB

Official record

MedPublished 07 Nov 2025, 22:02 WIB

CVE-2025-12860

DedeBIZ freelist_main.php sql injection

A vulnerability was found in DedeBIZ up to 6.3.2. Affected is an unknown function of the file /admin/freelist_main.php. The manipulation of the argument orderby results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T15:02:08.895Z. Updated 2026-02-24T06:24:23.182Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:24 WIB

Official record

MedPublished 07 Nov 2025, 22:02 WIB

CVE-2025-12859

DedeBIZ templets_one_edit.php sql injection

A vulnerability has been found in DedeBIZ up to 6.3.2. This impacts an unknown function of the file /admin/templets_one_edit.php. The manipulation of the argument ids leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T15:02:06.353Z. Updated 2026-02-24T06:24:10.952Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:24 WIB

Official record

MedPublished 07 Nov 2025, 21:02 WIB

CVE-2025-12857

code-projects Responsive Hotel Site roombook.php sql injection

A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook.php. Such manipulation of the argument rid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T14:02:06.372Z. Updated 2025-11-07T14:45:22.090Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 21:45 WIB

Official record

CritPublished 07 Nov 2025, 20:51 WIB

CVE-2025-34299

Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T13:51:33.738Z. Updated 2026-05-14T02:08:11.703Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:08 WIB

Official record

MedPublished 07 Nov 2025, 20:32 WIB

CVE-2025-12856

code-projects Responsive Hotel Site reservation.php sql injection

A weakness has been identified in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/reservation.php. This manipulation of the argument email causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T13:32:08.786Z. Updated 2025-11-07T17:19:51.164Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated08 Nov 2025, 00:19 WIB

Official record

MedPublished 07 Nov 2025, 20:32 WIB

CVE-2025-12855

code-projects Responsive Hotel Site newsletterdel.php sql injection

A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php. The manipulation of the argument eid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T13:32:06.643Z. Updated 2025-11-07T15:57:29.740Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 22:57 WIB

Official record

HighPublished 07 Nov 2025, 20:08 WIB

CVE-2025-10968

SQLi in GG Soft's PaperWork

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection. This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T13:08:41.209Z. Updated 2026-06-05T06:33:45.320Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 13:33 WIB

Official record

MedPublished 07 Nov 2025, 19:32 WIB

CVE-2025-12854

newbee-mall-plus seckillExecution executeSeckill authorization

A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The manipulation of the argument userid leads to authorization bypass. It is possible to initiate the attack remotely. The attack is considered to have high complexity. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T12:32:09.758Z. Updated 2025-11-07T13:04:37.110Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 20:04 WIB

Official record

MedPublished 07 Nov 2025, 19:32 WIB

CVE-2025-12853

SourceCodester Best House Rental Management System admin_class.php delete_house sql injection

A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T12:32:07.272Z. Updated 2025-11-07T13:07:26.074Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 20:07 WIB

Official record

CritPublished 07 Nov 2025, 16:26 WIB

CVE-2025-10870

SQL injection in DIAL's CentrosNet

SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the 'ultralogin' parameter in '/centrosnet/ultralogin.php'.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T09:26:39.503Z. Updated 2025-11-07T12:09:38.397Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 19:09 WIB

Official record

MedPublished 07 Nov 2025, 15:51 WIB

CVE-2025-46413

CVE-2025-46413

Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacker.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T08:51:52.847Z. Updated 2025-11-07T13:15:18.610Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 20:15 WIB

Official record

UnscoredPublished 07 Nov 2025, 14:26 WIB

CVE-2025-10966

missing SFTP host verification with wolfSSH

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T07:26:30.351Z. Updated 2026-09-15T06:02:24.883Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Sep 2026, 13:02 WIB

Official record

MedPublished 07 Nov 2025, 12:32 WIB

CVE-2025-64346

archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T05:32:09.605Z. Updated 2025-11-07T13:19:52.595Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 20:19 WIB

Official record

MedPublished 07 Nov 2025, 12:29 WIB

CVE-2025-12527

Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion

The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T05:29:58.432Z. Updated 2026-04-08T17:09:46.076Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:09 WIB

Official record

MedPublished 07 Nov 2025, 12:29 WIB

CVE-2025-12520

WP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting

The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This makes it possible for authenticated attackers, with administrator-level p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T05:29:57.900Z. Updated 2026-04-08T16:56:37.713Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:56 WIB

Official record

HighPublished 07 Nov 2025, 12:20 WIB

CVE-2025-64343

(conda) Constructor: Excessive permissions during and after installation

(conda) Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write access by authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T05:20:38.659Z. Updated 2025-11-07T17:24:38.228Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 00:24 WIB

Official record

HighPublished 07 Nov 2025, 12:12 WIB

CVE-2025-64339

ClipBucket v5: Stored XSS Vulnerability in Manage Playlists

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML/JavaScript c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T05:12:37.704Z. Updated 2025-11-07T17:33:46.877Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated08 Nov 2025, 00:33 WIB

Official record

HighPublished 07 Nov 2025, 11:32 WIB

CVE-2025-64336

ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T04:32:10.401Z. Updated 2025-11-07T17:38:36.524Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated08 Nov 2025, 00:38 WIB

Official record