Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 841–860 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 23 Sep 2025, 10:02 WIB

CVE-2025-10834

itsourcecode Open Source Job Portal login.php sql injection

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument user_email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T03:02:07.288Z. Updated 2025-09-23T14:34:32.270Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 21:34 WIB

Official record

MedPublished 23 Sep 2025, 09:32 WIB

CVE-2025-10833

1000projects Bookstore Management System login.php sql injection

A vulnerability was determined in 1000projects Bookstore Management System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument unm causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 841 to 860 of 4319.First page Next page

Published 2025-09-23T02:32:06.097Z. Updated 2025-09-23T14:37:14.939Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 21:37 WIB

Official record

MedPublished 23 Sep 2025, 09:08 WIB

CVE-2025-58915

WordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T02:08:41.364Z. Updated 2026-04-28T16:13:49.319Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

MedPublished 23 Sep 2025, 09:02 WIB

CVE-2025-10832

SourceCodester Pet Grooming Management Software fetch_product_details.php sql injection

A vulnerability was found in SourceCodester Pet Grooming Management Software 1.0. The affected element is an unknown function of the file /admin/fetch_product_details.php. The manipulation of the argument barcode results in sql injection. The attack may be performed from remote. The exploit has been made public and cou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T02:02:06.363Z. Updated 2025-09-23T13:30:49.619Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:30 WIB

Official record

MedPublished 23 Sep 2025, 08:58 WIB

CVE-2025-42907

Server-Side Request Forgery in SAP BI Platform

SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T01:58:28.486Z. Updated 2025-10-14T00:17:56.274Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated14 Oct 2025, 07:17 WIB

Official record

MedPublished 23 Sep 2025, 08:32 WIB

CVE-2025-10831

Campcodes Computer Sales and Inventory System pro_edit1.php sql injection

A vulnerability has been found in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. The manipulation of the argument prodcode leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T01:32:08.574Z. Updated 2025-09-23T13:32:27.932Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:32 WIB

Official record

MedPublished 23 Sep 2025, 08:32 WIB

CVE-2025-10830

Campcodes Computer Sales and Inventory System inv_edit1.php sql injection

A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/inv_edit1.php. Executing manipulation of the argument idd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T01:32:05.733Z. Updated 2025-09-23T13:33:16.855Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:33 WIB

Official record

HighPublished 23 Sep 2025, 08:16 WIB

CVE-2025-9495

Viessmann Vitogate 300 Authentication Bypass

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidde…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T01:16:53.619Z. Updated 2025-09-23T13:33:47.319Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:33 WIB

Official record

HighPublished 23 Sep 2025, 08:12 WIB

CVE-2025-9494

Viessmann Vitogate 300 OS Command Injection

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T01:12:17.459Z. Updated 2025-09-23T13:34:06.974Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:34 WIB

Official record

MedPublished 23 Sep 2025, 08:02 WIB

CVE-2025-10829

Campcodes Computer Sales and Inventory System sup_edit1.php sql injection

A vulnerability was detected in Campcodes Computer Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/sup_edit1.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T01:02:11.191Z. Updated 2025-09-23T13:35:00.827Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Sep 2025, 20:35 WIB

Official record

MedPublished 23 Sep 2025, 08:02 WIB

CVE-2025-10828

SourceCodester Pet Grooming Management Software edit.php sql injection

A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T01:02:07.974Z. Updated 2025-09-23T19:36:05.125Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2025, 02:36 WIB

Official record

MedPublished 23 Sep 2025, 07:32 WIB

CVE-2025-10827

PHPJabbers Restaurant Menu Maker preview.php cross site scripting

A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. This manipulation of the argument theme causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:32:09.601Z. Updated 2025-09-23T19:39:50.135Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2025, 02:39 WIB

Official record

MedPublished 23 Sep 2025, 07:32 WIB

CVE-2025-10826

Campcodes Online Beauty Parlor Management System sales-reports-detail.php sql injection

A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:32:06.675Z. Updated 2025-09-23T19:50:02.881Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2025, 02:50 WIB

Official record

MedPublished 23 Sep 2025, 07:02 WIB

CVE-2025-10825

Campcodes Online Beauty Parlor Management System view-appointment.php sql injection

A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. Affected is an unknown function of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:02:09.845Z. Updated 2025-09-23T19:52:17.849Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2025, 02:52 WIB

Official record

MedPublished 23 Sep 2025, 07:02 WIB

CVE-2025-10824

axboe fio init.c __parse_jobs_ini use after free

A vulnerability was determined in axboe fio up to 3.41. This impacts the function __parse_jobs_ini of the file init.c. Executing manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:02:06.575Z. Updated 2025-09-23T19:55:20.846Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated24 Sep 2025, 02:55 WIB

Official record

UnscoredPublished 23 Sep 2025, 07:00 WIB

CVE-2025-29083

CVE-2025-29083

SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Plugin_Manager.php file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:00:00.000Z. Updated 2025-09-24T18:34:25.232Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2025, 01:34 WIB

Official record

UnscoredPublished 23 Sep 2025, 07:00 WIB

CVE-2025-29084

CVE-2025-29084

SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Upgrade.php file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:00:00.000Z. Updated 2025-09-24T18:35:12.639Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2025, 01:35 WIB

Official record

UnscoredPublished 23 Sep 2025, 07:00 WIB

CVE-2025-45326

CVE-2025-45326

An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submit_size.php component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:00:00.000Z. Updated 2025-09-24T18:39:53.919Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2025, 01:39 WIB

Official record

UnscoredPublished 23 Sep 2025, 07:00 WIB

CVE-2025-51005

CVE-2025-51005

A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1. When a crafted pcap file is processed, the program incorrectly handles memory in the checksum calculation logic at do_checksum_math_liveplay in tcpliveplay.c, leading to a possible denial of service.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:00:00.000Z. Updated 2025-09-24T18:40:33.403Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2025, 01:40 WIB

Official record

UnscoredPublished 23 Sep 2025, 07:00 WIB

CVE-2025-55780

CVE-2025-55780

A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-23T00:00:00.000Z. Updated 2025-09-25T14:47:03.426Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2025, 21:47 WIB

Official record