Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 341–360 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 31 Mar 2025, 12:31 WIB

CVE-2025-2978

WCMS Article Publishing Page CKEditor unrestricted upload

A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/upload/?&CKEditor=container&CKEditorFuncNum=1 of the component Article Publishing Page. The manipulation of the argument Upload leads to unrestricted upload. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T05:31:04.473Z. Updated 2025-03-31T12:50:41.668Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 19:50 WIB

Official record

MedPublished 31 Mar 2025, 12:00 WIB

CVE-2025-2977

GFI KerioConnect PDF File cross site scripting

A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 341 to 360 of 4001.First page Next page

Published 2025-03-31T05:00:08.371Z. Updated 2025-03-31T12:56:33.980Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 19:56 WIB

Official record

HighPublished 31 Mar 2025, 11:54 WIB

CVE-2025-31103

CVE-2025-31103

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T04:54:03.868Z. Updated 2025-03-31T12:59:20.794Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 19:59 WIB

Official record

CritPublished 31 Mar 2025, 11:49 WIB

CVE-2025-26689

CVE-2025-26689

Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote attacker sends a specially crafted HTTP request to the product, the product data may be obtained or deleted, and/or the product settings may be altered.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T04:49:30.059Z. Updated 2025-03-31T15:58:55.013Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 22:58 WIB

Official record

CritPublished 31 Mar 2025, 11:49 WIB

CVE-2025-25211

CVE-2025-25211

Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T04:49:19.439Z. Updated 2025-03-31T16:01:20.073Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 23:01 WIB

Official record

MedPublished 31 Mar 2025, 11:49 WIB

CVE-2025-24852

CVE-2025-24852

Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T04:49:07.988Z. Updated 2025-03-31T16:02:38.648Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 23:02 WIB

Official record

HighPublished 31 Mar 2025, 11:48 WIB

CVE-2025-24517

CVE-2025-24517

Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T04:48:57.473Z. Updated 2025-03-31T12:59:34.323Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 19:59 WIB

Official record

MedPublished 31 Mar 2025, 11:31 WIB

CVE-2025-2976

GFI KerioConnect File Upload cross site scripting

A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T04:31:04.158Z. Updated 2025-03-31T13:33:46.323Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:33 WIB

Official record

MedPublished 31 Mar 2025, 11:00 WIB

CVE-2025-2975

GFI KerioConnect Signature EditHtmlSource cross site scripting

A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file Settings/Email/Signature/EditHtmlSource of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has bee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T04:00:10.553Z. Updated 2025-03-31T16:03:53.750Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 23:03 WIB

Official record

HighPublished 31 Mar 2025, 10:48 WIB

CVE-2025-3014

Insecure direct object references (IDOR) in NightWolf Penetration Platform

Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T03:48:12.504Z. Updated 2025-03-31T13:37:51.896Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:37 WIB

Official record

HighPublished 31 Mar 2025, 10:40 WIB

CVE-2025-3013

Insecure direct object references (IDOR) in NightWolf Penetration Platform

Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T03:40:04.534Z. Updated 2025-03-31T15:55:30.308Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 22:55 WIB

Official record

MedPublished 31 Mar 2025, 10:31 WIB

CVE-2025-2974

CodeCanyon Perfex CRM Contracts contract cross site scripting

A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T03:31:05.880Z. Updated 2025-03-31T16:04:34.258Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 23:04 WIB

Official record

CritPublished 31 Mar 2025, 10:30 WIB

CVE-2025-3011

PiExtract SOOP-CLM - SQL Injection

SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T03:30:48.092Z. Updated 2025-03-31T13:00:10.205Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:00 WIB

Official record

MedPublished 31 Mar 2025, 10:00 WIB

CVE-2025-2973

code-projects College Management System student.php unrestricted upload

A vulnerability, which was classified as critical, was found in code-projects College Management System 1.0. This affects an unknown part of the file /Admin/student.php. The manipulation of the argument profile_image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T03:00:07.703Z. Updated 2025-03-31T13:00:50.549Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:00 WIB

Official record

CritPublished 31 Mar 2025, 07:52 WIB

CVE-2025-1268

CVE-2025-1268

Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Dri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:52:18.516Z. Updated 2026-03-15T23:36:05.782Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated16 Mar 2026, 06:36 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54802

CVE-2024-54802

In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T14:27:20.979Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 21:27 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54803

CVE-2024-54803

Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter pppoe_peer_mac and forcing a reboot. This will result in command injection.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T14:15:48.341Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 21:15 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54804

CVE-2024-54804

Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter wan_hostname and forcing a reboot. This will result in command injection.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T14:13:02.109Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 21:13 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54805

CVE-2024-54805

Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter get_email. After which, they can visit the send_log.cgi endpoint which uses the parameter in a system call to achieve command execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T14:09:30.194Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 21:09 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54806

CVE-2024-54806

Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T14:07:09.674Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 21:07 WIB

Official record