Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 681–700 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-50753

CVE-2025-50753

Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be used from restricted shell to show files and directories. By providing " /bin/sh" (quotes included) to the argument of this command will drop a root shell.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2026-08-04T15:30:22.494Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Aug 2026, 22:30 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-50971

CVE-2025-50971

Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-09-04T14:33:41.434Z.

CVSS

Showing 681 to 700 of 3629.First page Next page

—

KEVNot listed

EPSSPresent

Updated04 Sep 2025, 21:33 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-50974

CVE-2025-50974

The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of the following paramet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T16:19:37.030Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 23:19 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-50975

CVE-2025-50975

IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr, allowing an authenticated administrator to inject persistent JavaScript. This stored XSS payload is executed whenever anothe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:44:04.464Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:44 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-50976

CVE-2025-50976

IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T16:20:49.320Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 23:20 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52035

CVE-2025-52035

A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08) and was fixed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-26T15:27:13.375Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:27 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52036

CVE-2025-52036

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b07…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-26T15:26:10.222Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:26 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52037

CVE-2025-52037

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b24…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-26T15:25:01.777Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:25 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52184

CVE-2025-52184

Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T16:17:40.376Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 23:17 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52217

CVE-2025-52217

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing injection of arbitrary HTML.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:16:00.991Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:16 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52218

CVE-2025-52218

SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sanitization of unspecified parameters allows attackers to inject arbitrary text or limited HTML into the login page.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:12:55.370Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:12 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52219

CVE-2025-52219

SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fields can be used to create arbitrary external links via HTML Injection.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-26T16:07:34.820Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 23:07 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-52353

CVE-2025-52353

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-28T16:31:44.060Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2025, 23:31 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-55443

CVE-2025-55443

Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platform to execute administ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:05:54.639Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:05 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-55526

CVE-2025-55526

n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:24:24.268Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:24 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-56432

CVE-2025-56432

A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2026-07-05T01:10:26.894Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:10 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-57425

CVE-2025-57425

A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript into the 'question' and 'answer' fields via the update-faq.php endpoint.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T16:01:58.749Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 23:01 WIB

Official record

MedPublished 26 Aug 2025, 06:32 WIB

CVE-2025-9429

mtons mblog Post submit cross site scripting

A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post Handler. The manipulation of the argument content/title/ leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been discl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T23:32:10.844Z. Updated 2025-08-26T20:21:43.342Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 03:21 WIB

Official record

MedPublished 26 Aug 2025, 06:02 WIB

CVE-2025-9426

itsourcecode Online Tour and Travel Management System package.php sql injection

A weakness has been identified in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /package.php. Executing manipulation of the argument subcatid can lead to sql injection. The attack may be performed from a remote location. The exploit has been made available to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T23:02:10.901Z. Updated 2025-08-26T20:21:02.956Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 03:21 WIB

Official record

MedPublished 26 Aug 2025, 06:02 WIB

CVE-2025-9425

itsourcecode Online Tour and Travel Management System enquiry.php sql injection

A security flaw has been discovered in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /enquiry.php. Performing manipulation of the argument pid results in sql injection. The attack is possible to be carried out remotely. The exploit has been r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T23:02:07.942Z. Updated 2025-08-26T14:22:34.897Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Aug 2025, 21:22 WIB

Official record