Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 3161–3180 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

MedPublished 06 Jun 2025, 13:42 WIB

CVE-2025-5019

Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function

The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the hs_update_ai_chat_settings() function. This makes it possible fo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:42:49.240Z. Updated 2026-04-08T16:52:16.318Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:52 WIB

Official record

MedPublished 06 Jun 2025, 13:42 WIB

CVE-2025-5534

ESV Bible Shortcode for WordPress <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3161 to 3180 of 3682.First page Next page

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:42:48.851Z. Updated 2026-04-08T16:48:31.401Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

MedPublished 06 Jun 2025, 13:42 WIB

CVE-2025-5533

Knowledge Base <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:42:48.260Z. Updated 2026-04-08T16:48:20.743Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

MedPublished 06 Jun 2025, 13:42 WIB

CVE-2024-58114

CVE-2024-58114

Resource allocation control failure vulnerability in the ArkUI framework Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:42:00.360Z. Updated 2025-06-06T15:54:44.486Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated06 Jun 2025, 22:54 WIB

Official record

MedPublished 06 Jun 2025, 13:41 WIB

CVE-2025-48907

CVE-2025-48907

Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:41:03.604Z. Updated 2025-06-09T13:26:13.593Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:26 WIB

Official record

HighPublished 06 Jun 2025, 13:40 WIB

CVE-2025-48906

CVE-2025-48906

Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:40:06.196Z. Updated 2025-06-09T13:27:11.116Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:27 WIB

Official record

HighPublished 06 Jun 2025, 13:38 WIB

CVE-2025-48905

CVE-2025-48905

Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may cause the failure to capture specific Wasm exception types.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:38:54.430Z. Updated 2025-06-09T13:27:26.470Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:27 WIB

Official record

MedPublished 06 Jun 2025, 13:36 WIB

CVE-2025-48904

CVE-2025-48904

Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:36:17.624Z. Updated 2025-06-09T13:27:53.508Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:27 WIB

Official record

HighPublished 06 Jun 2025, 13:34 WIB

CVE-2025-48903

CVE-2025-48903

Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:34:14.173Z. Updated 2025-06-09T13:28:07.613Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:28 WIB

Official record

MedPublished 06 Jun 2025, 13:33 WIB

CVE-2025-48902

CVE-2025-48902

Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may affect availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:33:12.711Z. Updated 2025-06-09T13:26:27.060Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:26 WIB

Official record

MedPublished 06 Jun 2025, 13:31 WIB

CVE-2025-5727

SourceCodester Student Result Management System Announcement Page announcement cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /script/academic/announcement of the component Announcement Page. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:31:05.700Z. Updated 2025-06-06T16:05:48.938Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated06 Jun 2025, 23:05 WIB

Official record

MedPublished 06 Jun 2025, 13:00 WIB

CVE-2025-5726

SourceCodester Student Result Management System Division System Page division-system cross site scripting

A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /script/academic/division-system of the component Division System Page. The manipulation of the argument Division leads to cross site scrip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:00:15.357Z. Updated 2025-06-06T15:59:33.536Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated06 Jun 2025, 22:59 WIB

Official record

UnscoredPublished 06 Jun 2025, 13:00 WIB

CVE-2023-2921

Short URL <= 1.6.8 - Subscriber+ SQLi

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T06:00:05.014Z. Updated 2025-06-09T19:45:35.897Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Jun 2025, 02:45 WIB

Official record

MedPublished 06 Jun 2025, 12:31 WIB

CVE-2025-5725

SourceCodester Student Result Management System Grading System Page grading-system cross site scripting

A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /script/academic/grading-system of the component Grading System Page. The manipulation of the argument Remark leads to cross site …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T05:31:07.519Z. Updated 2025-06-09T13:28:35.260Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:28 WIB

Official record

MedPublished 06 Jun 2025, 12:31 WIB

CVE-2025-5724

SourceCodester Student Result Management System Subjects Page subjects cross site scripting

A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /script/academic/subjects of the component Subjects Page. The manipulation of the argument Subject leads to cross site scripting. It is possible to launch …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T05:31:05.615Z. Updated 2025-06-09T13:29:04.310Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:29 WIB

Official record

MedPublished 06 Jun 2025, 12:22 WIB

CVE-2025-1777

BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save

The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T05:22:43.193Z. Updated 2026-04-08T17:34:31.448Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:34 WIB

Official record

MedPublished 06 Jun 2025, 12:22 WIB

CVE-2025-1778

Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete

The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'arttheme_theme_option_restore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the theme option.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T05:22:42.535Z. Updated 2026-04-08T17:20:51.025Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 06 Jun 2025, 12:00 WIB

CVE-2025-5723

SourceCodester Student Result Management System Classes Page classes cross site scripting

A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /script/academic/classes of the component Classes Page. The manipulation of the argument Class Name leads to cross site scripting. The attack may be init…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T05:00:19.576Z. Updated 2025-06-09T13:31:59.756Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:31 WIB

Official record

MedPublished 06 Jun 2025, 11:31 WIB

CVE-2025-5722

SourceCodester Student Result Management System Add Academic Term terms cross site scripting

A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /script/academic/terms of the component Add Academic Term. The manipulation of the argument Academic Term leads to cross site scripting. The attack can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T04:31:06.058Z. Updated 2025-06-09T13:32:25.258Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated09 Jun 2025, 20:32 WIB

Official record

MedPublished 06 Jun 2025, 11:29 WIB

CVE-2025-36513

CVE-2025-36513

Cross-site request forgery vulnerability exists in surveillance cameras provided by i-PRO Co., Ltd.. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-06T04:29:36.521Z. Updated 2025-06-06T14:07:38.803Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated06 Jun 2025, 21:07 WIB

Official record