Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,980 published records · 19 KEV · 3,980 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,980 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2446.1%
High95724%
Med1,53639%
Low1193.0%
None00.00%
Legacy00.00%
Unscored1,12428%

Matching records by UTC month

May 253,980

Signal coverage

KEV-listed: 19
With a forecast: 3,980
Unknown date: 0
Unscored severity: 1,124

Share of cohort: KEV 0.48% · forecast 100% · unscored 28%.

Showing 661–680 of 3,980By severity band: Critical · 9.0–10.0 244, High · 7.0–8.9 957, Medium · 4.0–6.9 1,536, Low · 0.1–3.9 119, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,124

MedPublished 23 May 2025, 10:39 WIB

CVE-2025-4594

Tournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T03:39:40.713Z. Updated 2026-04-08T17:34:48.225Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:34 WIB

Official record

UnscoredPublished 23 May 2025, 08:09 WIB

CVE-2025-5100

KL-001-2025-005: Mobile Dynamix PrinterShare Mobile Print Double-Free Memory Write

A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T01:09:41.306Z. Updated 2025-05-27T15:57:12.302Z.

Showing 661 to 680 of 3980.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated27 May 2025, 22:57 WIB

Official record

UnscoredPublished 23 May 2025, 08:06 WIB

CVE-2025-5098

KL-001-2025-003: Mobile Dynamix PrinterShare Mobile Print Gmail Oauth Token Disclosure

PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T01:06:25.126Z. Updated 2025-05-23T15:40:02.026Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2025, 22:40 WIB

Official record

UnscoredPublished 23 May 2025, 08:05 WIB

CVE-2025-5099

KL-001-2025-004: Mobile Dynamix PrinterShare Mobile Print Out-of-bounds Write

An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T01:05:53.182Z. Updated 2025-05-23T15:40:38.399Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2025, 22:40 WIB

Official record

MedPublished 23 May 2025, 07:03 WIB

CVE-2025-2394

Disclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile Applications

Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:03:32.603Z. Updated 2025-09-30T05:50:10.557Z.

CVSS4.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 12:50 WIB

Official record

HighPublished 23 May 2025, 07:00 WIB

CVE-2023-34873

CVE-2023-34873

On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated users to execute code.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-23T18:19:15.324Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 May 2025, 01:19 WIB

Official record

LowPublished 23 May 2025, 07:00 WIB

CVE-2023-53154

CVE-2023-53154

parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-11-03T19:28:58.976Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:28 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-48702

CVE-2024-48702

PHPGurukul Old Age Home Management System v1.0 is vulnerable to HTML Injection via the searchdata parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-29T15:13:12.031Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:13 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-48704

CVE-2024-48704

Phpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-06-02T17:59:12.381Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jun 2025, 00:59 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-51099

CVE-2024-51099

A reflected cross-site scripting (XSS) vulnerability in the component mcgs/download-medical-cards.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the searchdata parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-29T15:10:26.366Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:10 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-51101

CVE-2024-51101

PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /rtbs/check-status.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-29T15:14:56.393Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:14 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-51102

CVE-2024-51102

PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/login.php via the username and password parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-23T18:43:44.845Z.

CVSS—KEVNot listedEPSSPresentUpdated24 May 2025, 01:43 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-51103

CVE-2024-51103

PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/password-recovery.php via the emailid and id parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-23T15:47:17.575Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2025, 22:47 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-51107

CVE-2024-51107

Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle, pagedes, and email parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-29T15:18:18.172Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:18 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-51108

CVE-2024-51108

Multiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fromdate and todate parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-29T15:17:21.136Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:17 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2024-51360

CVE-2024-51360

An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-29T15:16:21.750Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:16 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2025-44998

CVE-2025-44998

A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecting a crafted payload into the js-theme-3 parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-23T18:56:35.929Z.

CVSS—KEVNot listedEPSSPresentUpdated24 May 2025, 01:56 WIB

Official record

UnscoredPublished 23 May 2025, 07:00 WIB

CVE-2025-46176

CVE-2025-46176

Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary commands via firmware analysis.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-23T18:54:16.599Z.

CVSS—KEVNot listedEPSSPresentUpdated24 May 2025, 01:54 WIB

Official record

MedPublished 23 May 2025, 07:00 WIB

CVE-2025-48695

CVE-2025-48695

An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their privilege by abusing the following API due to the lack of access control: /api/v2/users/user/<user id>/role/ROLE/<Target role> (admin access can be achieved).

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-23T13:20:39.550Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated23 May 2025, 20:20 WIB

Official record

MedPublished 23 May 2025, 07:00 WIB

CVE-2025-48701

CVE-2025-48701

openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-23T00:00:00.000Z. Updated 2025-05-23T13:22:17.392Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated23 May 2025, 20:22 WIB

Official record