Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 461–480 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

LowPublished 28 Jul 2025, 13:02 WIB

CVE-2025-8260

Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash

A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T06:02:05.309Z. Updated 2026-04-15T07:02:44.090Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated15 Apr 2026, 14:02 WIB

Official record

MedPublished 28 Jul 2025, 12:32 WIB

CVE-2025-8259

Vaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injection

A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_server.php of the component Web interface. Such manipulation of the argument xajaxargs leads to os command injection. The attack can be executed remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 461 to 480 of 3774.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T05:32:04.923Z. Updated 2026-04-15T07:08:25.330Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Apr 2026, 14:08 WIB

Official record

MedPublished 28 Jul 2025, 12:02 WIB

CVE-2025-8258

Cool Mo Maigcal Number App com.sdmagic.number AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, has been found in Cool Mo Maigcal Number App up to 1.0.3 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.sdmagic.number. The manipulation leads to improper export of android application components…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T05:02:10.197Z. Updated 2025-07-28T16:01:00.434Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:01 WIB

Official record

HighPublished 28 Jul 2025, 12:00 WIB

CVE-2025-8267

CVE-2025-8267

Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targetin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T05:00:00.992Z. Updated 2025-07-28T16:01:35.358Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:01 WIB

Official record

MedPublished 28 Jul 2025, 11:32 WIB

CVE-2025-8257

Lobby Universe Lobby App com.maverick.lobby AndroidManifest.xml improper export of android application components

A vulnerability classified as problematic was found in Lobby Universe Lobby App up to 2.8.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.maverick.lobby. The manipulation leads to improper export of android application components. The attack …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T04:32:05.048Z. Updated 2025-07-28T16:02:40.557Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:02 WIB

Official record

MedPublished 28 Jul 2025, 11:02 WIB

CVE-2025-8256

code-projects Online Ordering System product.php unrestricted upload

A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T04:02:04.909Z. Updated 2025-07-28T16:07:15.035Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:07 WIB

Official record

MedPublished 28 Jul 2025, 10:32 WIB

CVE-2025-8255

code-projects Exam Form Submission register.php unrestricted upload

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /register.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the publi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T03:32:06.230Z. Updated 2025-07-28T16:11:22.323Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:11 WIB

Official record

MedPublished 28 Jul 2025, 10:02 WIB

CVE-2025-8254

Campcodes Courier Management System view_parcel.php sql injection

A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T03:02:05.384Z. Updated 2025-07-28T16:18:00.341Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:18 WIB

Official record

MedPublished 28 Jul 2025, 09:32 WIB

CVE-2025-8253

code-projects Exam Form Submission delete_s6.php sql injection

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s6.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T02:32:05.692Z. Updated 2025-07-28T16:29:12.859Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:29 WIB

Official record

MedPublished 28 Jul 2025, 09:02 WIB

CVE-2025-8252

code-projects Exam Form Submission delete_s5.php sql injection

A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s5.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T02:02:05.594Z. Updated 2025-07-28T17:18:14.216Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:18 WIB

Official record

MedPublished 28 Jul 2025, 08:32 WIB

CVE-2025-8251

code-projects Exam Form Submission delete_s4.php sql injection

A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s4.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclose…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T01:32:05.426Z. Updated 2025-07-28T17:18:43.684Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:18 WIB

Official record

MedPublished 28 Jul 2025, 08:04 WIB

CVE-2025-8250

code-projects Exam Form Submission update_s4.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s4.php. The manipulation of the argument credits leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T01:04:06.696Z. Updated 2025-07-28T17:22:43.549Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:22 WIB

Official record

MedPublished 28 Jul 2025, 07:32 WIB

CVE-2025-8249

code-projects Exam Form Submission update_s3.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s3.php. The manipulation of the argument credits leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:32:05.710Z. Updated 2025-07-28T13:34:29.254Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 20:34 WIB

Official record

MedPublished 28 Jul 2025, 07:02 WIB

CVE-2025-8248

code-projects Online Ordering System signup.php sql injection

A vulnerability classified as critical was found in code-projects Online Ordering System 1.0. This vulnerability affects unknown code of the file /signup.php. The manipulation of the argument firstname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:02:06.348Z. Updated 2025-07-28T17:16:24.252Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:16 WIB

Official record

MedPublished 28 Jul 2025, 07:00 WIB

CVE-2022-50237

CVE-2022-50237

The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:00:00.000Z. Updated 2025-07-28T13:56:12.178Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 20:56 WIB

Official record

MedPublished 28 Jul 2025, 07:00 WIB

CVE-2023-53158

CVE-2023-53158

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:00:00.000Z. Updated 2025-07-28T17:24:12.615Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:24 WIB

Official record

MedPublished 28 Jul 2025, 07:00 WIB

CVE-2023-53159

CVE-2023-53159

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:00:00.000Z. Updated 2025-07-28T13:54:23.689Z.

CVSS4.5v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 20:54 WIB

Official record

LowPublished 28 Jul 2025, 07:00 WIB

CVE-2023-53160

CVE-2023-53160

The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:00:00.000Z. Updated 2025-07-28T13:53:39.946Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 20:53 WIB

Official record

LowPublished 28 Jul 2025, 07:00 WIB

CVE-2023-53161

CVE-2023-53161

The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:00:00.000Z. Updated 2025-07-28T13:52:30.036Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 20:52 WIB

Official record

UnscoredPublished 28 Jul 2025, 07:00 WIB

CVE-2025-29534

CVE-2025-29534

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is pass…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T00:00:00.000Z. Updated 2026-07-05T01:03:56.966Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:03 WIB

Official record