Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1–20 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

MedPublished 01 Dec 2025, 06:32 WIB

CVE-2025-13796

deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. The attack can be execut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T23:32:06.222Z. Updated 2025-12-01T17:39:04.227Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Dec 2025, 00:39 WIB

Official record

MedPublished 01 Dec 2025, 06:02 WIB

CVE-2025-13795

codingWithElias School Management System Edit Student Info student-view.php cross site scripting

A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of the file /student-view.php of the component Edit Student Info Page. This manipulation of the argument First Name causes cross site scripting. Remote exploitation …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 3020.Next page

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T23:02:06.304Z. Updated 2025-12-01T17:40:56.613Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated02 Dec 2025, 00:40 WIB

Official record

CritPublished 01 Dec 2025, 04:27 WIB

CVE-2025-35028

HexStrike AI MCP Server Command Injection

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There is no attempt to sanit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T21:27:56.057Z. Updated 2025-12-01T17:58:12.880Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated02 Dec 2025, 00:58 WIB

Official record

MedPublished 01 Dec 2025, 00:02 WIB

CVE-2025-13793

winston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scripting

A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown functionality of the file /includes/header_menu.php of the component GET Parameter Handler. Executing manipulation of the argument Error can lead to cross site script…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T17:02:06.228Z. Updated 2025-12-01T17:45:53.572Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Dec 2025, 00:45 WIB

Official record

MedPublished 30 Nov 2025, 23:02 WIB

CVE-2025-13792

Qualitor getResumo.php eval code injection

A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento/request/getResumo.php. Performing a manipulation of the argument passageiros results in code injection. Remote exploitation of the attack is possible. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T16:02:05.632Z. Updated 2026-02-24T06:38:48.473Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:38 WIB

Official record

MedPublished 30 Nov 2025, 22:32 WIB

CVE-2025-13791

Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal

A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T15:32:05.524Z. Updated 2026-02-24T06:38:36.366Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:38 WIB

Official record

MedPublished 30 Nov 2025, 21:32 WIB

CVE-2025-13790

Scada-LTS cross-site request forgery

A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T14:32:06.199Z. Updated 2026-02-24T06:38:24.040Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:38 WIB

Official record

MedPublished 30 Nov 2025, 20:32 WIB

CVE-2025-13789

ZenTao model.php makeRequest server-side request forgery

A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 21.7.6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T13:32:16.964Z. Updated 2025-12-01T15:48:42.607Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Dec 2025, 22:48 WIB

Official record

MedPublished 30 Nov 2025, 19:32 WIB

CVE-2025-13788

Chanjet CRM upgradeattribute.php sql injection

A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The ven…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T12:32:05.610Z. Updated 2025-12-01T15:51:05.822Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Dec 2025, 22:51 WIB

Official record

MedPublished 30 Nov 2025, 17:32 WIB

CVE-2025-13787

ZenTao File control.php delete privileges management

A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to vers…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T10:32:08.651Z. Updated 2025-12-01T15:03:55.578Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Dec 2025, 22:03 WIB

Official record

MedPublished 30 Nov 2025, 16:02 WIB

CVE-2025-13786

taosir WTCMS index.php fetch code injection

A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T09:02:05.334Z. Updated 2025-12-01T21:06:46.543Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Dec 2025, 04:06 WIB

Official record

MedPublished 30 Nov 2025, 14:32 WIB

CVE-2025-13785

yungifez Skuul School Management System Image profile information disclosure

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T07:32:05.160Z. Updated 2025-12-02T17:23:12.635Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated03 Dec 2025, 00:23 WIB

Official record

MedPublished 30 Nov 2025, 14:02 WIB

CVE-2025-13784

yungifez Skuul School Management System SVG File edit cross site scripting

A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1/edit of the component SVG File Handler. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T07:02:05.901Z. Updated 2025-12-03T15:30:37.589Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated03 Dec 2025, 22:30 WIB

Official record

MedPublished 30 Nov 2025, 13:02 WIB

CVE-2025-13783

taosir WTCMS CommentadminController CommentadminController.class.php delete sql injection

A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument ids results in sql inje…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T06:02:08.577Z. Updated 2025-12-03T15:42:05.492Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated03 Dec 2025, 22:42 WIB

Official record

MedPublished 30 Nov 2025, 10:02 WIB

CVE-2025-13782

taosir WTCMS SlideController SlideController.class.php delete sql injection

A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file application/Admin/Controller/SlideController.class.php of the component SlideController. The manipulation of the argument ids leads to sql injection. Remote exploitati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T03:02:08.567Z. Updated 2025-12-03T15:43:46.002Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Dec 2025, 22:43 WIB

Official record

CritPublished 30 Nov 2025, 08:53 WIB

CVE-2025-13615

StreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change

The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T01:53:13.258Z. Updated 2026-04-08T17:17:43.665Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record

MedPublished 30 Nov 2025, 07:00 WIB

CVE-2025-66420

CVE-2025-66420

Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T00:00:00.000Z. Updated 2025-12-01T14:10:50.632Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Dec 2025, 21:10 WIB

Official record

MedPublished 30 Nov 2025, 07:00 WIB

CVE-2025-66421

CVE-2025-66421

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T00:00:00.000Z. Updated 2025-12-01T14:10:45.597Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Dec 2025, 21:10 WIB

Official record

MedPublished 30 Nov 2025, 07:00 WIB

CVE-2025-66422

CVE-2025-66422

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T00:00:00.000Z. Updated 2025-12-01T14:10:40.069Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Dec 2025, 21:10 WIB

Official record

HighPublished 30 Nov 2025, 07:00 WIB

CVE-2025-66423

CVE-2025-66423

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-30T00:00:00.000Z. Updated 2025-12-01T14:10:34.912Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Dec 2025, 21:10 WIB

Official record