Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 3701–3720 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 01 Jul 2025, 22:32 WIB

CVE-2025-6962

Campcodes Employee Management System myprofileup.php sql injection

A vulnerability, which was classified as critical, was found in Campcodes Employee Management System 1.0. This affects an unknown part of the file /myprofileup.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T15:32:08.265Z. Updated 2025-07-01T15:47:17.009Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:47 WIB

Official record

MedPublished 01 Jul 2025, 22:32 WIB

CVE-2025-6961

Campcodes Employee Management System mark.php sql injection

A vulnerability, which was classified as critical, has been found in Campcodes Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /mark.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3701 to 3720 of 3774.First page Next page

Published 2025-07-01T15:32:06.164Z. Updated 2025-07-01T15:56:58.015Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:56 WIB

Official record

MedPublished 01 Jul 2025, 22:02 WIB

CVE-2025-6960

Campcodes Employee Management System empproject.php sql injection

A vulnerability classified as critical was found in Campcodes Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /empproject.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T15:02:08.575Z. Updated 2025-07-01T15:29:59.116Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:29 WIB

Official record

MedPublished 01 Jul 2025, 22:02 WIB

CVE-2025-6959

Campcodes Employee Management System eloginwel.php sql injection

A vulnerability classified as critical has been found in Campcodes Employee Management System 1.0. Affected is an unknown function of the file /eloginwel.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T15:02:06.228Z. Updated 2025-07-01T15:32:19.693Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:32 WIB

Official record

MedPublished 01 Jul 2025, 21:53 WIB

CVE-2025-53099

Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a user's account. With a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:53:16.878Z. Updated 2025-07-01T15:06:29.774Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:06 WIB

Official record

CritPublished 01 Jul 2025, 21:49 WIB

CVE-2025-34064

OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:49:34.048Z. Updated 2025-07-01T15:12:31.755Z.

CVSS9v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:12 WIB

Official record

CritPublished 01 Jul 2025, 21:49 WIB

CVE-2025-34063

OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin ten…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:49:25.544Z. Updated 2025-07-01T15:17:11.538Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:17 WIB

Official record

MedPublished 01 Jul 2025, 21:49 WIB

CVE-2025-34062

OneLogin AD Connector API Credential and Signing Key Exposure

An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:49:20.131Z. Updated 2025-07-01T15:35:09.487Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 22:35 WIB

Official record

CritPublished 01 Jul 2025, 21:49 WIB

CVE-2025-34060

Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:49:02.069Z. Updated 2025-07-01T18:41:44.536Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated02 Jul 2025, 01:41 WIB

Official record

HighPublished 01 Jul 2025, 21:48 WIB

CVE-2025-34059

Dahua Smart Cloud Gateway Registration Management Platform SQL Injection

An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:48:51.722Z. Updated 2025-11-20T18:34:32.177Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Nov 2025, 01:34 WIB

Official record

HighPublished 01 Jul 2025, 21:48 WIB

CVE-2025-34058

Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read

Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory tra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:48:40.033Z. Updated 2026-07-14T22:25:42.020Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 05:25 WIB

Official record

HighPublished 01 Jul 2025, 21:47 WIB

CVE-2025-34066

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:47:44.573Z. Updated 2026-04-07T14:09:19.390Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

MedPublished 01 Jul 2025, 21:47 WIB

CVE-2025-34065

AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:47:23.621Z. Updated 2026-04-07T14:09:18.570Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

CritPublished 01 Jul 2025, 21:46 WIB

CVE-2025-34056

AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:46:52.800Z. Updated 2026-04-07T14:09:17.710Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

CritPublished 01 Jul 2025, 21:46 WIB

CVE-2025-34055

AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system she…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:46:38.848Z. Updated 2026-04-07T14:09:16.960Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

CritPublished 01 Jul 2025, 21:46 WIB

CVE-2025-34054

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection

An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by the Shad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:46:00.832Z. Updated 2026-04-07T14:09:16.220Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

MedPublished 01 Jul 2025, 21:45 WIB

CVE-2025-34053

AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:45:02.858Z. Updated 2026-04-07T14:09:15.581Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

MedPublished 01 Jul 2025, 21:44 WIB

CVE-2025-34051

AVTECH DVR Devices Server-Side Request Forgery

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to interna…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:44:22.913Z. Updated 2026-04-07T14:09:14.685Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

MedPublished 01 Jul 2025, 21:42 WIB

CVE-2025-34050

AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery

A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:42:57.143Z. Updated 2026-04-07T14:09:13.996Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

UnscoredPublished 01 Jul 2025, 21:39 WIB

CVE-2025-37098

CVE-2025-37098

A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-01T14:39:11.831Z. Updated 2025-07-01T14:55:36.836Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Jul 2025, 21:55 WIB

Official record