Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 501–520 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

CritPublished 26 Jun 2025, 09:06 WIB

CVE-2025-4334

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T02:06:34.765Z. Updated 2026-04-08T17:20:02.002Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-6383

WP-PhotoNav <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode

The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 501 to 520 of 3682.First page Next page

Published 2025-06-26T02:06:34.379Z. Updated 2026-04-08T17:19:38.104Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:19 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-6290

Tournament Bracket Generator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode

The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T02:06:34.003Z. Updated 2026-04-08T17:19:02.629Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:19 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-5812

VG WORT METIS <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update

The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() function in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited pos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T02:06:33.607Z. Updated 2026-04-08T17:18:09.318Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:18 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-6378

Responsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode

The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T02:06:33.229Z. Updated 2026-04-08T16:45:41.391Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-6538

Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T02:06:32.835Z. Updated 2026-04-08T16:36:28.250Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:36 WIB

Official record

MedPublished 26 Jun 2025, 09:06 WIB

CVE-2025-3863

Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function

The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to tr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T02:06:32.222Z. Updated 2026-04-08T16:34:53.032Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:34 WIB

Official record

HighPublished 26 Jun 2025, 08:44 WIB

CVE-2025-5590

Owl carousel responsive <= 1.9 - Authenticated (Contributor+) SQL Injection via id Parameter

The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T01:44:39.625Z. Updated 2026-04-08T17:29:04.210Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:29 WIB

Official record

MedPublished 26 Jun 2025, 08:44 WIB

CVE-2025-5488

WP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T01:44:39.248Z. Updated 2026-04-08T16:57:48.201Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:57 WIB

Official record

MedPublished 26 Jun 2025, 08:44 WIB

CVE-2025-5535

e.nigma buttons <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T01:44:38.853Z. Updated 2026-04-08T16:51:14.193Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:51 WIB

Official record

MedPublished 26 Jun 2025, 08:44 WIB

CVE-2025-5588

Image Editor by Pixo <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter

The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T01:44:38.259Z. Updated 2026-04-08T16:35:55.796Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

CritPublished 26 Jun 2025, 07:00 WIB

CVE-2024-52928

CVE-2024-52928

Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-27T13:38:43.810Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 20:38 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2024-56915

CVE-2024-56915

Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-26T15:18:35.229Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Jun 2025, 22:18 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2025-29331

CVE-2025-29331

An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passes the no check certificate option to wget when downloading updates

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-26T15:11:23.166Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Jun 2025, 22:11 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2025-30131

CVE-2025-30131

An issue was discovered on IROAD Dashcam FX2 devices. An unauthenticated file upload endpoint can be leveraged to execute arbitrary commands by uploading a CGI-based webshell. Once a file is uploaded, the attacker can execute commands with root privileges, gaining full control over the dashcam. Additionally, by uploadi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-26T20:24:08.614Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Jun 2025, 03:24 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2025-44141

CVE-2025-44141

A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2026-07-05T01:00:24.195Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:00 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2025-49603

CVE-2025-49603

Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-26T20:25:34.285Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Jun 2025, 03:25 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2025-50350

CVE-2025-50350

PHPGurukul Pre-School Enrollment System Project v1.0 is vulnerable to Directory Traversal in manage-classes.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-26T19:04:25.761Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:04 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2025-51671

CVE-2025-51671

A SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability allows remote attackers to execute arbitrary SQL code via the category and categorycode parameters in a POST request to the manage-categories.php file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-26T19:56:03.068Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:56 WIB

Official record

UnscoredPublished 26 Jun 2025, 07:00 WIB

CVE-2025-51672

CVE-2025-51672

A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3. The vulnerability exists in the manage-companies.php file and allows remote attackers to execute arbitrary SQL code via the companyname parameter in a POST request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T00:00:00.000Z. Updated 2025-06-26T15:41:47.983Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Jun 2025, 22:41 WIB

Official record