Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 3641–3660 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

MedPublished 02 Jun 2025, 07:31 WIB

CVE-2025-5421

juzaweb CMS Plugin Editor Page editor access control

A vulnerability, which was classified as critical, has been found in juzaweb CMS up to 3.4.2. Affected by this issue is some unknown functionality of the file /admin-cp/plugin/editor of the component Plugin Editor Page. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:31:04.139Z. Updated 2025-06-02T03:29:49.870Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:29 WIB

Official record

MedPublished 02 Jun 2025, 07:00 WIB

CVE-2025-5420

juzaweb CMS Profile Page upload cross site scripting

A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/file-manager/upload of the component Profile Page. The manipulation of the argument Upload leads to cross site scripting. The attack can be launched remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3641 to 3660 of 3682.First page Next page

Published 2025-06-02T00:00:15.186Z. Updated 2025-06-02T03:31:39.878Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:31 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2024-40112

CVE-2024-40112

A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate the "language" cookie to include arbitrary files from the server. This vulnerability can be exploited to disclose sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T19:04:00.383Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 02:04 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2024-40113

CVE-2024-40113

Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T19:34:57.553Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 02:34 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2024-40114

CVE-2024-40114

A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language cookie to inject malicious JavaScript code.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T19:39:28.932Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 02:39 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2024-57459

CVE-2024-57459

A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not properly validate user input, allowing an attacker to inject arbitrary SQL commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T16:13:08.948Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jun 2025, 23:13 WIB

Official record

HighPublished 02 Jun 2025, 07:00 WIB

CVE-2024-57783

CVE-2024-57783

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T14:13:30.990Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated02 Jun 2025, 21:13 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-23099

CVE-2025-23099

An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-03T01:53:09.087Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 08:53 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-23104

CVE-2025-23104

An issue was discovered in Samsung Mobile Processor Exynos 2200. A Use-After-Free in the mobile processor leads to privilege escalation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-09T13:45:24.670Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:45 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-23105

CVE-2025-23105

An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-03T01:51:18.895Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 08:51 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-27953

CVE-2025-27953

An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session management component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-11T15:27:10.253Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 22:27 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-27954

CVE-2025-27954

An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken function of default.aspx.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-11T15:27:08.776Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 22:27 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-27955

CVE-2025-27955

Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-11T15:27:11.679Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 22:27 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-27956

CVE-2025-27956

Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T20:37:32.086Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 03:37 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-44115

CVE-2025-44115

A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T20:00:57.212Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 03:00 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-44172

CVE-2025-44172

Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T18:10:37.643Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 01:10 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-45387

CVE-2025-45387

osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T20:33:09.293Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 03:33 WIB

Official record

UnscoredPublished 02 Jun 2025, 07:00 WIB

CVE-2025-45542

CVE-2025-45542

SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-03T16:03:33.764Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 23:03 WIB

Official record

LowPublished 02 Jun 2025, 07:00 WIB

CVE-2025-49112

CVE-2025-49112

setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2025-06-02T16:58:20.615Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated02 Jun 2025, 23:58 WIB

Official record

CritKEVPublished 02 Jun 2025, 07:00 WIB

CVE-2025-49113

CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-06-02T00:00:00.000Z. Updated 2026-02-21T04:56:23.141Z.

CVSS9.9v3.1KEVListedEPSSPresentUpdated21 Feb 2026, 11:56 WIB

Official record