Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 3241–3260 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

CritPublished 09 Sep 2025, 05:40 WIB

CVE-2025-58745

WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)

WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary file upload vulnerability. The WeGIA only check MIME types for Excel files at endpoint `/html/socio/sistema/controller/controla_xlsx.php`, which can be bypassed by using magic bytes of Excel file in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:40:56.389Z. Updated 2025-09-09T13:29:48.697Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:29 WIB

Official record

HighPublished 09 Sep 2025, 05:35 WIB

CVE-2025-58454

WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'listar_despachos.php' parameter 'id_memorando'

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in WeGIA versions 3.4.10 and prior inthe endpoint /WeGIA/html/memorando/listar_despachos.php, in the id_memorando parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3241 to 3260 of 4319.First page Next page

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:35:04.799Z. Updated 2025-09-09T13:29:54.619Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:29 WIB

Official record

MedPublished 09 Sep 2025, 05:32 WIB

CVE-2025-10110

ChanCMS search sql injection

A vulnerability was identified in ChanCMS up to 3.3.1. Impacted is an unknown function of the file /search/. The manipulation with the input '%20or%201=1%20%23/words.html leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:32:09.780Z. Updated 2025-09-09T13:30:00.587Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

MedPublished 09 Sep 2025, 05:32 WIB

CVE-2025-10109

Campcodes Online Loan Management System ajax.php sql injection

A vulnerability was determined in Campcodes Online Loan Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_payment. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:32:07.408Z. Updated 2025-09-09T13:30:09.327Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

HighPublished 09 Sep 2025, 05:28 WIB

CVE-2025-58453

WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'exibe_anexo.php' parameter 'id_anexo'

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in WeGIA versions 3.4.10 and prior in the endpoint /WeGIA/html/memorando/exibe_anexo.php, in the id_anexo parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:28:40.515Z. Updated 2025-09-09T13:30:15.073Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

LowPublished 09 Sep 2025, 05:26 WIB

CVE-2025-58452

WeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar_despachos.php' parameter 'id_memorando'

WeGIA is a Web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the listar_despachos.php endpoint of the WeGIA application prior to version 3.4.11. This vulnerability allows attackers to inject malicious scripts in the id_memorando parameter. Version 3.4.11 con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:26:24.115Z. Updated 2025-09-09T13:30:21.252Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

MedPublished 09 Sep 2025, 05:13 WIB

CVE-2025-1761

IBM Concert Software information disclosure

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:13:50.248Z. Updated 2025-09-09T13:30:27.403Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

HighPublished 09 Sep 2025, 05:07 WIB

CVE-2025-58451

Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption

Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially exponential worst-case complexity. This could cause excessive CPU usage due to excessive backtracking on crafted inputs. In turn, the excessive CPU usage could lead to resource exhaustion, where proce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:07:48.516Z. Updated 2025-09-09T13:30:32.906Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

MedPublished 09 Sep 2025, 05:02 WIB

CVE-2025-10108

Campcodes Online Loan Management System ajax.php sql injection

A vulnerability was found in Campcodes Online Loan Management System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_loan. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T22:02:07.597Z. Updated 2025-09-09T13:30:38.245Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

CritPublished 09 Sep 2025, 04:35 WIB

CVE-2025-58450

pREST has Systemic SQL Injection Vulnerability

pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a patch to mitigate such…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:35:01.452Z. Updated 2025-09-09T13:30:44.306Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

MedPublished 09 Sep 2025, 04:32 WIB

CVE-2025-10106

yanyutao0402 ChanCMS search sql injection

A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.1. This affects an unknown part of the file /cms/collect/search. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:32:05.519Z. Updated 2025-09-09T13:30:50.538Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

HighPublished 09 Sep 2025, 04:27 WIB

CVE-2025-58449

Maho Vulnerable to Authenticated Remote Code Execution via File Upload

Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to the `Dashboard` and `Catalog\Manage Products` permissions can create a custom option on a listing with a file input field. By allowing file uploads with a `.php` extension, the user can use the filed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:27:55.103Z. Updated 2025-09-09T13:30:56.695Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:30 WIB

Official record

HighPublished 09 Sep 2025, 04:24 WIB

CVE-2025-58444

MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to interact directly with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:24:58.821Z. Updated 2025-09-09T13:31:04.737Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:31 WIB

Official record

HighPublished 09 Sep 2025, 04:19 WIB

CVE-2025-58365

XWiki Blog Application: Privilege Escalation (PR) from account through blog content

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. For an exploit, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:19:09.381Z. Updated 2025-09-09T13:37:45.479Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:37 WIB

Official record

HighPublished 09 Sep 2025, 04:17 WIB

CVE-2025-57817

Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate their privileges to own…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:17:09.105Z. Updated 2025-09-09T13:39:00.895Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:39 WIB

Official record

MedPublished 09 Sep 2025, 04:14 WIB

CVE-2025-57816

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:14:06.853Z. Updated 2025-09-09T14:19:27.430Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 21:19 WIB

Official record

LowPublished 09 Sep 2025, 04:12 WIB

CVE-2025-57766

Fides's Admin UI User Password Change Does Not Invalidate Current Session

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access eve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:12:07.626Z. Updated 2025-09-09T13:45:07.885Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:45 WIB

Official record

LowPublished 09 Sep 2025, 04:11 WIB

CVE-2025-57815

Fides Lacks Brute-Force Protections on Authentication Endpoints

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T21:11:53.369Z. Updated 2025-09-09T13:44:06.409Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 20:44 WIB

Official record

MedPublished 09 Sep 2025, 03:32 WIB

CVE-2025-10105

yanyutao0402 ChanCMS search sql injection

A flaw has been found in yanyutao0402 ChanCMS up to 3.3.1. Affected by this issue is some unknown functionality of the file /cms/article/search. This manipulation of the argument keyword causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T20:32:07.660Z. Updated 2025-09-08T20:43:07.322Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 03:43 WIB

Official record

MedPublished 09 Sep 2025, 03:02 WIB

CVE-2025-10104

code-projects Online Event Judging System review_search.php sql injection

A security vulnerability has been detected in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /review_search.php. The manipulation of the argument txtsearch leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-08T20:02:06.910Z. Updated 2025-09-08T20:19:51.283Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 03:19 WIB

Official record