Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 3281–3300 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

HighPublished 04 Apr 2025, 12:22 WIB

CVE-2024-13708

Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:22:46.789Z. Updated 2025-04-04T13:07:23.784Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated04 Apr 2025, 20:07 WIB

Official record

HighPublished 04 Apr 2025, 12:22 WIB

CVE-2025-2270

Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific filenames on the server, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3281 to 3300 of 4033.First page Next page

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:22:46.133Z. Updated 2026-04-08T17:20:05.019Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 04 Apr 2025, 12:22 WIB

CVE-2025-2836

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:22:45.468Z. Updated 2026-04-08T17:11:22.593Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:11 WIB

Official record

MedPublished 04 Apr 2025, 12:22 WIB

CVE-2024-13898

Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:22:44.837Z. Updated 2026-04-08T16:58:48.189Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:58 WIB

Official record

CritPublished 04 Apr 2025, 12:22 WIB

CVE-2024-13645

TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:22:44.092Z. Updated 2026-04-08T16:48:35.505Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

HighPublished 04 Apr 2025, 12:22 WIB

CVE-2025-2317

Product Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter

The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all versions up to, and including, 2.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:22:43.213Z. Updated 2026-04-08T16:45:21.311Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

MedPublished 04 Apr 2025, 12:00 WIB

CVE-2025-3210

code-projects Patient Record Management System birthing_pending.php sql injection

A vulnerability was found in code-projects Patient Record Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /birthing_pending.php. The manipulation of the argument birth_id leads to sql injection. The attack may be launched remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:00:13.723Z. Updated 2025-04-04T13:12:46.024Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 20:12 WIB

Official record

HighPublished 04 Apr 2025, 12:00 WIB

CVE-2025-3192

CVE-2025-3192

Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:00:11.940Z. Updated 2026-08-02T15:25:17.954Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated02 Aug 2026, 22:25 WIB

Official record

MedPublished 04 Apr 2025, 12:00 WIB

CVE-2025-3209

code-projects Patient Record Management System add_patient.php sql injection

A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add_patient.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:00:11.651Z. Updated 2025-04-04T14:46:19.604Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 21:46 WIB

Official record

MedPublished 04 Apr 2025, 12:00 WIB

CVE-2025-3191

CVE-2025-3191

All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:00:11.024Z. Updated 2025-04-04T14:09:12.840Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated04 Apr 2025, 21:09 WIB

Official record

HighPublished 04 Apr 2025, 12:00 WIB

CVE-2025-3197

CVE-2025-3197

Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:00:09.872Z. Updated 2025-04-04T14:17:14.575Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated04 Apr 2025, 21:17 WIB

Official record

HighPublished 04 Apr 2025, 12:00 WIB

CVE-2025-3194

CVE-2025-3194

Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the application.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T05:00:05.529Z. Updated 2026-07-18T15:25:27.001Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Jul 2026, 22:25 WIB

Official record

MedPublished 04 Apr 2025, 11:31 WIB

CVE-2025-3208

code-projects Patient Record Management System xray_print.php sql injection

A vulnerability was found in code-projects Patient Record Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /xray_print.php. The manipulation of the argument itr_no leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T04:31:04.932Z. Updated 2025-04-04T14:46:38.672Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 21:46 WIB

Official record

HighPublished 04 Apr 2025, 11:21 WIB

CVE-2024-13744

Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload

The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T04:21:22.827Z. Updated 2025-04-04T14:46:51.411Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated04 Apr 2025, 21:46 WIB

Official record

HighPublished 04 Apr 2025, 11:21 WIB

CVE-2025-2075

Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() func…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T04:21:22.091Z. Updated 2026-04-08T17:04:52.226Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

MedPublished 04 Apr 2025, 11:00 WIB

CVE-2025-3207

code-projects Patient Record Management System birthing_form.php sql injection

A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /birthing_form.php. The manipulation of the argument birth_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T04:00:10.038Z. Updated 2025-04-04T20:20:43.775Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Apr 2025, 03:20 WIB

Official record

MedPublished 04 Apr 2025, 10:31 WIB

CVE-2025-3206

code-projects Hospital Management System doctor-specilization.php sql injection

A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. The attack can be initiated remotely. The exploit h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T03:31:05.315Z. Updated 2025-04-04T20:20:51.779Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Apr 2025, 03:20 WIB

Official record

MedPublished 04 Apr 2025, 10:00 WIB

CVE-2025-3205

CodeAstro Student Grading System studentsubject.php sql injection

A vulnerability, which was classified as critical, was found in CodeAstro Student Grading System 1.0. This affects an unknown part of the file studentsubject.php. The manipulation of the argument studentId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T03:00:16.819Z. Updated 2025-04-04T14:19:00.752Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 21:19 WIB

Official record

MedPublished 04 Apr 2025, 10:00 WIB

CVE-2025-3204

CodeAstro Car Rental System returncar.php sql injection

A vulnerability, which was classified as critical, has been found in CodeAstro Car Rental System 1.0. Affected by this issue is some unknown functionality of the file /returncar.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T03:00:13.795Z. Updated 2025-04-04T15:42:00.575Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 22:42 WIB

Official record

MedPublished 04 Apr 2025, 09:31 WIB

CVE-2025-3203

Tenda W18E setModules formSetAccountList stack-based overflow

A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountList of the file /goform/setModules. The manipulation of the argument Password leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-04T02:31:09.829Z. Updated 2025-04-04T15:45:15.623Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 22:45 WIB

Official record