Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 821–840 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 19 Nov 2025, 23:20 WIB

CVE-2025-34337

eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints

eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attackers to generate valid ciphertext for chosen values. The image…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T16:20:03.260Z. Updated 2026-07-28T01:48:04.367Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:48 WIB

Official record

MedPublished 19 Nov 2025, 23:08 WIB

CVE-2025-12766

Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc.

An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS).

Excerpt language: en.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 821 to 840 of 3020.First page Next page

Published 2025-11-19T16:08:50.016Z. Updated 2025-11-19T17:42:27.044Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated20 Nov 2025, 00:42 WIB

Official record

HighPublished 19 Nov 2025, 23:02 WIB

CVE-2025-65022

i-Educar Authenticated Time-based SQL Injection in `agenda.php`

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T16:02:13.336Z. Updated 2025-11-19T16:36:31.318Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:36 WIB

Official record

HighPublished 19 Nov 2025, 23:02 WIB

CVE-2025-65023

i-Educar Authenticated Time-based SQL Injection in `funcionario_vinculo_cad.php`

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the applicati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T16:02:10.539Z. Updated 2025-11-19T18:51:24.399Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated20 Nov 2025, 01:51 WIB

Official record

HighPublished 19 Nov 2025, 23:02 WIB

CVE-2025-65024

i-Educar Authenticated Time-based SQL Injection in `agenda_admin_cad.php`

i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's da…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T16:02:06.664Z. Updated 2025-11-24T20:26:41.251Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 03:26 WIB

Official record

HighPublished 19 Nov 2025, 22:47 WIB

CVE-2025-10703

CVE-2025-10703

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDire…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T15:47:07.908Z. Updated 2026-02-26T16:21:03.806Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:21 WIB

Official record

HighPublished 19 Nov 2025, 22:46 WIB

CVE-2025-10702

CVE-2025-10702

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDir…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T15:46:26.699Z. Updated 2026-02-26T16:21:04.463Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:21 WIB

Official record

MedPublished 19 Nov 2025, 22:32 WIB

CVE-2025-13397

mrubyc alloc.c mrbc_raw_realloc null pointer dereference

A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the argument ptr leads to null pointer dereference. An attack has to be approached locally. The name of the patch is 009111904807b8567262036bf45297c3da8f1c87. It is ad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T15:32:08.751Z. Updated 2025-11-19T16:48:37.028Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:48 WIB

Official record

MedPublished 19 Nov 2025, 22:32 WIB

CVE-2025-13396

code-projects Courier Management System add-office.php sql injection

A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T15:32:05.710Z. Updated 2025-11-19T16:46:18.939Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:46 WIB

Official record

MedPublished 19 Nov 2025, 21:03 WIB

CVE-2025-11963

Reflected XSS in Saysis's StarCities

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS. This issue affects StarCities: before 1.1.61.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T14:03:10.502Z. Updated 2026-06-04T07:10:04.041Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated04 Jun 2026, 14:10 WIB

Official record

MedPublished 19 Nov 2025, 20:28 WIB

CVE-2025-0421

iFrame Injection in Mikrogrup's Shopside

Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. This issue affects Shopside: through 05022025.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T13:28:36.779Z. Updated 2026-06-06T07:37:57.989Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:37 WIB

Official record

MedPublished 19 Nov 2025, 20:18 WIB

CVE-2024-8528

ALC WebCTRL Carrier i-Vu Reflected XSS due to unsanitized parameter

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T13:18:35.293Z. Updated 2025-11-19T15:15:57.698Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 22:15 WIB

Official record

HighPublished 19 Nov 2025, 20:17 WIB

CVE-2024-8527

ALC WebCTRL Carrier i-Vu Open Redirect via URL parameter

Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T13:17:01.911Z. Updated 2025-11-19T16:05:46.478Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:05 WIB

Official record

CritPublished 19 Nov 2025, 19:30 WIB

CVE-2025-12592

Use of default login credentials in Legacy Vivotek Devices

Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T12:30:32.854Z. Updated 2025-11-19T16:07:56.677Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:07 WIB

Official record

CritPublished 19 Nov 2025, 18:41 WIB

CVE-2025-10437

SQLi in Exagate's Webpack Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T11:41:06.202Z. Updated 2026-06-05T10:25:36.266Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 17:25 WIB

Official record

MedPublished 19 Nov 2025, 18:02 WIB

CVE-2025-13395

codehub666 94list function.php login sql injection

A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8. The impacted element is the function Login of the file /function.php. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T11:02:05.449Z. Updated 2025-11-19T16:09:53.921Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:09 WIB

Official record

UnscoredPublished 19 Nov 2025, 17:32 WIB

CVE-2025-64408

Apache Causeway: Java deserialization vulnerability to authenticated attackers

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T10:32:05.808Z. Updated 2026-02-26T16:21:05.654Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:21 WIB

Official record

HighPublished 19 Nov 2025, 17:27 WIB

CVE-2025-12472

Remote Code Execution in Looker due to Improperly Validated Directory Deletion

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted insta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T10:27:56.520Z. Updated 2025-11-19T16:24:04.479Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:24 WIB

Official record

MedPublished 19 Nov 2025, 16:49 WIB

CVE-2025-58412

CVE-2025-58412

A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T09:49:04.525Z. Updated 2026-02-26T16:21:06.365Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:21 WIB

Official record

HighPublished 19 Nov 2025, 16:28 WIB

CVE-2025-11230

Denial of service vulnerability in HAProxy mjson library

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T09:28:39.750Z. Updated 2025-11-19T17:09:15.642Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Nov 2025, 00:09 WIB

Official record