Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 4941–4960 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25704

Kados R10 GreenBee SQL Injection via filter_user_mail

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the filter_user_mail parameter. Attackers can send crafted requests with malicious SQL statements to extract sensitive database information or modify data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:42.597Z. Updated 2026-04-06T18:13:37.841Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:13 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25702

Kados R10 GreenBee SQL Injection via id_project Parameter

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_project parameter. Attackers can send crafted requests with malicious SQL statements in the id_project parameter to extract sensitive database information or modify data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4941 to 4960 of 5813.First page Next page

Published 2026-04-05T20:45:41.837Z. Updated 2026-04-06T18:15:49.342Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:15 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25700

Kados R10 GreenBee SQL Injection via sort_direction Parameter

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the sort_direction parameter. Attackers can submit malicious SQL statements in the sort_direction parameter to extract sensitive database information or modify data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:41.192Z. Updated 2026-04-06T18:15:12.213Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:15 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25698

Kados R10 GreenBee SQL Injection via id_to_delete Parameter

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_to_delete parameter. Attackers can send crafted requests with malicious SQL statements in the id_to_delete field to extract or modify sensitive database information.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:40.484Z. Updated 2026-04-06T18:14:22.541Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:14 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25696

Kados R10 GreenBee SQL Injection via language_tag Parameter

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the language_tag parameter. Attackers can submit malicious SQL statements in the language_tag parameter to extract sensitive database information or modify data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:39.759Z. Updated 2026-04-06T15:41:46.086Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:41 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25694

Kados R10 GreenBee SQL Injection via user2reset

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user2reset parameter. Attackers can send crafted requests with malicious SQL payloads to extract sensitive database information or modify data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:39.047Z. Updated 2026-04-06T18:02:53.097Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:02 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25692

Kados R10 GreenBee SQL Injection via id_to_modify Parameter

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id_to_modify' parameter. Attackers can send crafted requests with malicious SQL statements in the id_to_modify field to extract sensitive database information or modify data…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:38.386Z. Updated 2026-04-06T15:26:36.534Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:26 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25690

Kados R10 GreenBee SQL Injection via mng_profile_id

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the mng_profile_id parameter. Attackers can send crafted requests with malicious SQL payloads in the mng_profile_id parameter to extract sensitive database information.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:37.676Z. Updated 2026-04-06T15:26:48.748Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:26 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25688

Kados R10 GreenBee SQL Injection via menu_lev1 Parameter

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the menu_lev1 parameter. Attackers can send crafted requests with malicious SQL payloads in the menu_lev1 parameter to extract sensitive database information or m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:36.920Z. Updated 2026-04-06T15:26:57.981Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:26 WIB

Official record

CritPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25687

Pegasus CMS 1.0 Remote Code Execution via extra_fields.php

Pegasus CMS 1.0 contains a remote code execution vulnerability in the extra_fields.php plugin that allows unauthenticated attackers to execute arbitrary commands by exploiting unsafe eval functionality. Attackers can send POST requests to the submit.php endpoint with malicious PHP code in the action parameter to achiev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:36.223Z. Updated 2026-04-06T18:21:04.155Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:21 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25686

Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access violation and crash the FTP …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:35.338Z. Updated 2026-04-06T15:43:16.572Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:43 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25684

OpenDocMan 1.3.4 SQL Injection via where Parameter

OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:33.227Z. Updated 2026-04-06T15:07:34.416Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:07 WIB

Official record

MedPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25683

FileZilla 3.40.0 Denial of Service via Local Search

FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:32.632Z. Updated 2026-04-06T18:12:56.747Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:12 WIB

Official record

MedPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25682

CMSsite 1.0 Cross-Site Request Forgery via users.php

CMSsite 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting crafted pages that submit POST requests to the users.php endpoint with parameters like sou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:31.977Z. Updated 2026-04-06T15:27:11.308Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:27 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25681

Xlight FTP Server 3.9.1 SEH Overwrite Buffer Overflow

Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual server configuration …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:31.303Z. Updated 2026-04-06T18:24:46.806Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:24 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25680

Advance Gift Shop Pro Script 2.0.3 SQL Injection via search

Advance Gift Shop Pro Script 2.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can submit crafted SQL payloads in the 's' parameter of search requests to extract sensitive database info…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:30.633Z. Updated 2026-04-06T15:53:28.986Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:53 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25679

RealTerm Serial Terminal 2.0.0.70 Buffer Overflow SEH

RealTerm Serial Terminal 2.0.0.70 contains a structured exception handling (SEH) buffer overflow vulnerability in the Echo Port tab that allows local attackers to execute arbitrary code by supplying a malicious payload. Attackers can craft a buffer overflow payload with a POP POP RET gadget chain and shellcode that tri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:29.972Z. Updated 2026-04-06T18:02:53.380Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 01:02 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25678

C4G BLIS 3.4 SQL Injection via users_select.php

C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:29.306Z. Updated 2026-04-06T15:08:02.506Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:08 WIB

Official record

MedPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25677

WinRAR 5.61 Denial of Service via Malformed Language File

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:28.606Z. Updated 2026-07-15T01:24:07.717Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

HighPublished 06 Apr 2026, 03:45 WIB

CVE-2019-25676

Ask Expert Script 3.0.5 Cross Site Scripting SQL Injection

Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view parameter in list-details…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-05T20:45:27.951Z. Updated 2026-04-06T15:27:22.571Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated06 Apr 2026, 22:27 WIB

Official record