Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 3281–3300 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

UnscoredPublished 09 Jan 2025, 13:00 WIB

CVE-2024-12714

Backlink Monitoring Manager <= 0.1.3 - Reflected XSS

The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T06:00:05.935Z. Updated 2025-01-09T15:18:50.514Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jan 2025, 22:18 WIB

Official record

UnscoredPublished 09 Jan 2025, 13:00 WIB

CVE-2024-10815

PostLists <= 2.0.2 - Reflected XSS

The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T06:00:04.225Z. Updated 2025-01-09T16:01:25.757Z.

CVSS

Showing 3281 to 3300 of 4273.First page Next page

—

KEVNot listed

EPSSPresent

Updated09 Jan 2025, 23:01 WIB

Official record

MedPublished 09 Jan 2025, 12:00 WIB

CVE-2025-0333

leiyuxi cy-fast listData sql injection

A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0. Affected is the function listData of the file /sys/role/listData. The manipulation of the argument order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T05:00:12.824Z. Updated 2025-01-09T16:11:05.108Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 23:11 WIB

Official record

MedPublished 09 Jan 2025, 11:31 WIB

CVE-2025-0331

YunzMall HTTP POST Request ResetpwdController.php changePwd password recovery

A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to weak password recovery. The attack m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T04:31:09.870Z. Updated 2025-01-09T16:12:00.853Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 23:12 WIB

Official record

MedPublished 09 Jan 2025, 11:31 WIB

CVE-2025-0328

KaiYuanTong ECT Platform HTTP POST Request runCode.php command injection

A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command injection. The attack …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T04:31:06.588Z. Updated 2025-01-09T16:22:00.573Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 23:22 WIB

Official record

HighPublished 09 Jan 2025, 11:05 WIB

CVE-2025-0306

Ruby: openssl: ruby marvin attack

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T04:05:42.194Z. Updated 2026-06-29T23:24:34.331Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 06:24 WIB

Official record

MedPublished 09 Jan 2025, 11:00 WIB

CVE-2024-13213

SingMR HouseRent toAdminUpdateHousePage cross site scripting

A vulnerability classified as problematic was found in SingMR HouseRent 1.0. This vulnerability affects unknown code of the file /toAdminUpdateHousePage?hID=30. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T04:00:15.391Z. Updated 2025-01-09T15:38:07.338Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 22:38 WIB

Official record

MedPublished 09 Jan 2025, 11:00 WIB

CVE-2024-13212

SingMR HouseRent AddHouseController.java upload unrestricted upload

A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/house/wym/controller/AddHouseController.java. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T04:00:12.875Z. Updated 2025-01-09T15:38:43.822Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 22:38 WIB

Official record

MedPublished 09 Jan 2025, 10:40 WIB

CVE-2024-56827

Openjpeg: heap buffer overflow in lib/openjp2/j2k.c

A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T03:40:30.512Z. Updated 2025-11-06T22:33:36.987Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated07 Nov 2025, 05:33 WIB

Official record

MedPublished 09 Jan 2025, 10:40 WIB

CVE-2024-56826

Openjpeg: heap buffer overflow in bin/common/color.c

A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T03:40:24.613Z. Updated 2025-11-06T22:33:36.021Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated07 Nov 2025, 05:33 WIB

Official record

MedPublished 09 Jan 2025, 10:31 WIB

CVE-2024-13211

SingMR HouseRent AdminController.java access control

A vulnerability was found in SingMR HouseRent 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/main/java/com/house/wym/controller/AdminController.java. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T03:31:06.175Z. Updated 2025-01-09T15:46:38.557Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 22:46 WIB

Official record

MedPublished 09 Jan 2025, 10:31 WIB

CVE-2024-13210

donglight bookstore电商书城系统说明 AdminBookController. java uploadPicture unrestricted upload

A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of the file src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController. java. The manipulation of the argument pictureFile leads to unrestricted uplo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T03:31:04.605Z. Updated 2025-01-09T15:47:47.154Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 22:47 WIB

Official record

MedPublished 09 Jan 2025, 10:00 WIB

CVE-2024-13209

Redaxo CMS Structure Management Page index.php cross site scripting

A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0 of the component Structure Management Page. The manipulation of the argument Article Name leads to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T03:00:15.362Z. Updated 2025-01-09T15:50:00.953Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 22:50 WIB

Official record

HighPublished 09 Jan 2025, 10:00 WIB

CVE-2024-13206

REVE Antivirus reveinstall default permission

A vulnerability classified as critical has been found in REVE Antivirus 1.0.0.0 on Linux. This affects an unknown part of the file /usr/local/reveantivirus/tmp/reveinstall. The manipulation leads to incorrect default permissions. It is possible to launch the attack on the local host. The exploit has been disclosed to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T03:00:09.484Z. Updated 2025-01-09T15:58:14.785Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 22:58 WIB

Official record

MedPublished 09 Jan 2025, 09:31 WIB

CVE-2024-13205

kurniaramadhan E-Commerce-PHP Create Product Page create_product.php cross site scripting

A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/create_product.php of the component Create Product Page. The manipulation of the argument Name leads to cross site scripting. The attack may be launch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T02:31:04.629Z. Updated 2025-01-10T12:58:45.912Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated10 Jan 2025, 19:58 WIB

Official record

MedPublished 09 Jan 2025, 09:00 WIB

CVE-2024-13204

kurniaramadhan E-Commerce-PHP blog-details.php sql injection

A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /blog-details.php. The manipulation of the argument blog_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T02:00:17.765Z. Updated 2025-01-10T12:58:47.618Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Jan 2025, 19:58 WIB

Official record

MedPublished 09 Jan 2025, 09:00 WIB

CVE-2024-13203

kurniaramadhan E-Commerce-PHP cross-site request forgery

A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T02:00:15.952Z. Updated 2025-01-09T16:31:24.978Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 23:31 WIB

Official record

MedPublished 09 Jan 2025, 08:31 WIB

CVE-2024-13202

wander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scripting

A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic. This issue affects the function modifiyArticle of the file src/main/java/com/my/blog/website/controller/admin/PageController.java of the component Blog Article Handler. The manipulation of the argument content leads to cross site…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T01:31:06.386Z. Updated 2025-01-09T16:51:52.108Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 23:51 WIB

Official record

MedPublished 09 Jan 2025, 08:31 WIB

CVE-2024-13201

wander-chu SpringBoot-Blog Admin Attachment AttachtController.java upload unrestricted upload

A vulnerability has been found in wander-chu SpringBoot-Blog 1.0 and classified as critical. This vulnerability affects the function upload of the file src/main/java/com/my/blog/website/controller/admin/AttachtController.java of the component Admin Attachment Handler. The manipulation of the argument file leads to unre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T01:31:04.761Z. Updated 2025-01-09T16:00:39.122Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 23:00 WIB

Official record

MedPublished 09 Jan 2025, 08:00 WIB

CVE-2024-13200

wander-chu SpringBoot-Blog HTTP POST Request BaseInterceptor.java preHandle access control

A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java of the component HTTP POST Request Handler. The manipulation leads to improper access controls. It is possibl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T01:00:14.956Z. Updated 2025-01-09T16:01:26.166Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Jan 2025, 23:01 WIB

Official record